Aggregated Feature Vector Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely heavily on manual expert inspection and are not scalable, struggle to detect malware that exhibits benign functionality in some executions while malicious in others, and face high dimensionality issues with feature vectors, making accurate classification challenging.
Innovation Solution
The method involves performing dynamic analysis on a program along multiple execution paths, generating an aggregated feature vector from measurements across these paths, and applying a predictive model to classify the program as malicious or benign, using techniques such as statistical aggregation and unsupervised learning to reduce dimensionality and preserve relevant information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual expert inspection is used for malware detection, then detection accuracy can be maintained through expert knowledge, but scalability is severely limited and productivity is low
Solution Approach 1:
The patent replaces manual expert inspection (mechanical human analysis) with automated machine learning models that process dynamic analysis measurements. The system automatically extracts features from program executions and applies predictive models to classify malware, eliminating the need for manual expert review while maintaining detection accuracy through sophisticated algorithms.
Solution Approach 2:
The system enables self-service by allowing the malware detection system to automatically perform analysis without human intervention. The machine learning models autonomously process measurements, generate feature vectors, and classify programs as malicious or benign, making the detection process independent of expert knowledge while improving scalability.
2Reliability
If dynamic analysis is performed on multiple execution paths to detect polymorphic malware, then detection capability improves, but feature vector dimensionality increases making classification challenging
Solution Approach 1:
The patent extracts only the most relevant features from the dynamic analysis measurements to construct feature vectors. Instead of using all possible measurements from multiple execution paths, the system selectively extracts meaningful features that are most indicative of malicious behavior, thereby reducing dimensionality while preserving detection capability.
Solution Approach 2:
The patent inverts the traditional approach by first performing dynamic analysis on multiple execution paths to gather comprehensive measurements, then applying dimensionality reduction techniques to simplify the feature vectors. This inversion allows the system to benefit from multi-path analysis while avoiding the curse of dimensionality through subsequent feature selection and aggregation.
3Loss of information
If comprehensive dynamic analysis measurements are collected from multiple execution paths, then information completeness improves, but loss of time increases due to multiple executions
Solution Approach 1:
The patent applies partial action by performing dynamic analysis on a selected subset of execution paths rather than exhaustively analyzing all possible paths. The system strategically chooses execution paths that are most likely to reveal malicious behavior, gathering sufficient information for accurate classification without the time cost of complete path exploration.
Solution Approach 2:
The system performs preliminary static analysis to identify promising execution paths before conducting dynamic analysis. By pre-screening and selecting which paths to execute based on static characteristics, the system prepares in advance to focus dynamic analysis resources on the most informative paths, reducing overall analysis time while maintaining information completeness.
Data Source
AI summary
A method, apparatus and product performing feature vector aggregation for malware detection. Two sets of measurements produced by a two dynamic analyses of an examined program are obtained, wherein the two dynamic analyses are performed with respect to the examined program executing two different execution paths. An aggregated feature vector representing the examined program is generated. The aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements. A predictive model is applied on the aggregated feature vector to classify the examined program as malicious or benign.