AI Malware Detection in Virtual Machines Using Integrated Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing artificial intelligence-based detection technologies struggle to effectively identify new variants of malicious code, particularly those that employ packing or transformation to evade detection, resulting in low detection rates and potential catastrophic consequences for organizations.
Innovation Solution
A computing device and server system utilizing artificial neural networks to preprocess and analyze dynamic and static characteristics of target code, employing a virtualization profile to determine malicious code by selecting appropriate neural networks based on characteristic data types, and integrating log management for process termination and isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional signature-based detection methods are used, then the detection process is simple and fast, but the detection rate drops significantly against new malicious code variants that use packing or transformation techniques
Solution Approach 1:
The patent replaces traditional mechanical signature-based detection with artificial intelligence-based analysis. The system uses AI models to automatically analyze dynamic characteristics, behavioral patterns, and code structures of malicious code, substituting manual rule-based detection with intelligent automated analysis that can identify new variants without predefined signatures.
Solution Approach 2:
The patent changes the detection parameters from static signature matching to dynamic characteristic analysis. By monitoring runtime behaviors, system call patterns, memory access patterns, and execution flow characteristics, the system transforms the detection approach from fixed parameter matching to adaptive parameter analysis that evolves with new threats.
2Measurement precision
If AI-based detection technology is applied to improve detection rates, then the detection accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary analysis by extracting static characteristics and behavioral patterns before full detection. The system pre-processes code samples, identifies suspicious patterns early in the analysis pipeline, and uses these preliminary findings to guide subsequent deeper analysis, reducing overall processing time while maintaining high accuracy.
Solution Approach 2:
The patent segments the detection process into multiple independent stages: static analysis, dynamic analysis, characteristic extraction, pattern recognition, and final classification. Each stage processes specific aspects independently and passes results to the next stage, enabling parallel processing and reducing bottlenecks that would increase overall processing time.
3Reliability
If comprehensive dynamic characteristic analysis is performed to identify malicious code, then the detection capability against evasive techniques improves, but the system complexity and resource consumption increase
Solution Approach 1:
The patent extracts only the most relevant dynamic characteristics from the complex execution environment, such as system call sequences, API usage patterns, memory allocation behaviors, and network communication patterns. By selectively extracting key features rather than analyzing all possible parameters, the system maintains high detection capability while reducing processing complexity.
Solution Approach 2:
The patent introduces an intermediary layer that sits between the virtual machine execution environment and the analysis engine. This intermediary captures and filters dynamic characteristics, translating raw execution data into structured features that are easier to analyze. It acts as a mediator that simplifies the interface between complex execution monitoring and pattern recognition algorithms.
Data Source
AI summary
A computing device for determining a malicious code, comprising: a virtual information configured to generate a virtualization profile for a virtual machine to execute a target code detected using a terminal configuration information received from a target terminal; a determiner configured to preprocess at least one dynamic characteristic related to an avoid command for a virtualization system contained within the target code transmitted from the virtual machine of the target terminal, select at least one artificial neural network from a plurality of pre-trained artificial neural networks based on a characteristic value of the preprocessed at least one dynamic characteristic, and determine whether the target code is a malicious code using the selected artificial neural network.