AI Malware Detection via Multi-Level Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Advanced malware, particularly ransomware, poses a significant threat due to its dynamic nature and ability to bypass security checkpoints, leading to limited effectiveness of existing detection tools and significant annual losses exceeding $8 billion.
Innovation Solution
An AI-based advanced malware detection tool (AIMaD) employs a combination of static and dynamic analysis using machine learning, reverse engineering, and feature extraction at DLL, function call, and assembly levels, processed with NLP and association rule mining to detect malware with high accuracy and low false-positive rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection tools are used, then detection speed is maintained, but detection accuracy deteriorates due to the dynamic nature of advanced malware
Solution Approach 1:
The malware analysis is segmented into multiple levels: static analysis of binary properties, dynamic analysis of runtime behavior, and multi-level feature extraction at DLL, function call, and assembly levels. This segmentation allows comprehensive detection of advanced malware by examining different aspects separately and combining results.
Solution Approach 2:
The system transitions from traditional single-level detection to multi-dimensional analysis by incorporating both static and dynamic analysis dimensions, and further dividing dynamic analysis into DLL level, function call level, and assembly level features, creating a comprehensive multi-dimensional detection framework.
2Measurement precision
If multi-level analysis is performed to improve detection accuracy, then malware detection capability improves, but system complexity increases
Solution Approach 1:
Machine learning classifiers serve as intermediaries that automatically process and integrate features from multiple analysis levels (static features, DLL-level features, function call-level features, assembly-level features). The ML models handle the complexity of combining multi-level features, reducing the burden on the system architecture while maintaining high detection accuracy.
3Measurement precision
If advanced analysis techniques are used to detect dynamic malware, then detection accuracy improves, but processing time increases
Solution Approach 1:
Static analysis is performed preliminarily on malware binaries to extract structural features before dynamic execution. This preliminary action identifies suspicious patterns early in the analysis process, allowing the system to focus dynamic analysis resources on particularly suspicious samples and reduce overall processing time for benign files.
Data Source
AI summary
An artificial intelligence (AI) based advanced malware detection tool (AIMaD), which uses a combination of both static and dynamic malware analysis in a machine learning (ML) framework. It uses reverse engineering and feature extraction technique at DLL, function call, and assembly levels; these multi-level features are then processed with N-gram (i.e., Natural Language Processing, NLP), association rule mining to feed in different machine learning classifiers. The AIMaD is able to detect malware/ransomware with high accuracy and low false-positive rate.