Adaptive Detection Model Selection for Malicious File Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in detecting malicious files with characteristics different from known malicious files, and they lack effective methods for testing and retraining detection models, leading to inefficiencies in resource usage and detection accuracy.
Innovation Solution
A method and system for selecting a detection model that involves monitoring a file's execution, intercepting commands, forming a behavior log, analyzing the log to create a feature vector, and selecting detection models from a database based on this vector, utilizing machine learning techniques to improve detection accuracy and resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive analysis including both static and dynamic analysis is employed, then detection effectiveness is improved, but resource consumption and analysis time increase
Solution Approach 1:
The antivirus system divides the detection process into multiple independent modules: static analysis module, dynamic analysis module, heuristic analysis module, and machine learning module. Each module processes files independently and can be selectively applied based on file characteristics and threat levels, allowing the system to achieve comprehensive detection while controlling resource consumption by not always executing all modules simultaneously.
2Reliability
If dynamic analysis with execution or emulation is used, then detection effectiveness is improved, but analysis time and resource demands increase
Solution Approach 1:
The system implements dynamic detection methods that adaptively adjust the depth and type of analysis based on initial static analysis results and file characteristics. For low-risk files, only lightweight static analysis is performed. For suspicious files, the system progressively escalates to heuristic analysis and finally to full dynamic emulation, optimizing analysis time while maintaining high detection effectiveness through conditional execution of time-consuming operations.
3Measurement precision
If multiple detection models are maintained for different file characteristics, then detection accuracy for diverse malicious files is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal detection framework that can load and execute multiple specialized detection models through a common interface. The system maintains a database of detection models with different specialties (signature-based, behavior-based, machine learning-based) and selects appropriate models dynamically based on file characteristics. This universal architecture allows the system to handle diverse malicious files with high accuracy while managing complexity through standardized model interfaces and automated model selection logic.
Data Source
AI summary
Disclosed herein are methods and systems for selecting a detection model for detection of a malicious file. An exemplary method includes: monitoring a file during execution of the file within a computer system by intercepting commands of the file being executed and determining one or more parameters of the intercepted commands. A behavior log of the file being executed containing behavioral data is formed based on the intercepted commands and based on the one or more parameters of the intercepted commands. The behavior log is analyzed to form a feature vector. The feature vector characterizes the behavioral data. One or more detection models are selected from a database of detection models based on the feature vector. Each of the one or more detection models includes a decision-making rule for determining a degree of maliciousness of the file being executed.