AI Malicious File Analysis via Multi-Modality Intermediate Representations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Artificial intelligence models trained to process human-readable text are not equipped to detect cybersecurity threats hidden in various file modalities such as binary data, executable macros, and metadata, as they are tailored for processing human language.
Innovation Solution
An approach that analyzes multiple file modalities to generate analysis tokens, which are then used to produce an intermediate representation vector through a trained AI model, enabling detection of cybersecurity threats regardless of their underlying modality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If AI models are trained to process human-readable text, then they can effectively analyze text data, but they cannot detect cybersecurity threats hidden in various file modalities such as binary data, executable macros, and metadata
Solution Approach 1:
The system segments the analysis process into distinct modality-specific processing streams (binary data analysis, executable macro analysis, metadata analysis, etc.), where each stream is optimized for its specific file type. These segmented analyses are then aggregated to form a comprehensive threat assessment, allowing the AI model to handle diverse file modalities effectively
Solution Approach 2:
The system introduces intermediate processing layers that convert different file modalities into a unified representation format that the text-trained AI model can process. These intermediaries translate binary data, macros, and metadata into structured formats that preserve threat characteristics while making them compatible with the model's text-processing capabilities
2Reliability
If traditional malware detection tools are used, then they can identify known threats, but they are easily evaded by obfuscated or disguised malware
Solution Approach 1:
The system performs preliminary analysis of multiple file modalities and extracts meaningful features before the final threat classification. By analyzing binary data, macros, metadata, and other modalities in advance and converting them to structured representations, the system prepares comprehensive input for the AI model, enabling it to detect obfuscated threats that would evade traditional signature-based detection
Solution Approach 2:
The system creates a composite analysis approach by combining results from multiple modality analyses (binary, macro, metadata, behavioral) into a unified threat assessment. This composite approach leverages the strengths of each analysis type to detect threats that might be hidden in any single modality, significantly improving detection of obfuscated malware
Data Source
AI summary
The present disclosure provides an approach of analyzing multiple modalities of a file to produce multiple analysis tokens. Each one of the analysis tokens corresponds to a respective modality of the file. The approach provides the multiple analysis tokens to an artificial intelligence model, which is trained to produce an intermediate representation vector based on the plurality of analysis tokens. In turn the approach uses the artificial intelligence model to produce, based on the intermediate representation vector, a classification that indicates whether the file corresponds to a cybersecurity threat.