Alternating Malware Classifiers to Frustrate Brute-Force Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Heuristic-based malware detection technologies can be evaded by malware authors through brute-force testing, rendering malware undetectable and undermining the effectiveness of security software products.
Innovation Solution
Implementing a system that alternates between unique but similarly accurate malware classifiers within a security software product, randomly selecting and activating different classifiers at various intervals to frustrate brute-force testing efforts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If heuristic-based detection technologies are used to detect malware, then broader detection capabilities are provided, but malware authors can modify malware to become undetectable through brute-force testing
Solution Approach 1:
The patent implements dynamic classifier selection by randomly choosing which heuristic classifier to apply at runtime. Instead of using a fixed set of heuristics, the system dynamically switches between multiple classifiers (e.g., Classifier A, Classifier B, Classifier C) with different heuristic rules. This dynamic approach prevents malware authors from successfully brute-forcing a single static detection pattern, as the detection criteria change with each scan or time interval.
Solution Approach 2:
The system changes detection parameters by switching between multiple classifier configurations, each with different heuristic thresholds and rules. For example, one classifier might use file size thresholds of 100KB-1MB, while another uses 50KB-500KB. The random selection and alternation between classifiers with different parameter sets makes it impossible for malware to be optimized against a single parameter configuration.
2Reliability
If multiple classifiers are alternated to frustrate brute-force testing, then effectiveness against malware modification is improved, but system complexity increases
Solution Approach 1:
The patent creates multiple copies of the classifier system, where each copy (Classifier A, B, C, etc.) is a duplicate structure with slightly different heuristic parameters. Rather than implementing one complex adaptive classifier, the system uses simpler copied classifiers with fixed but varied rules. This copying approach manages complexity by using repetition of proven simple structures rather than creating one highly complex structure.
Solution Approach 2:
The detection system is segmented into multiple independent classifier modules, each handling a specific set of heuristic rules. The system divides the detection task across these segments and randomly selects which segment to execute. This segmentation reduces the complexity burden on any single classifier while maintaining overall detection effectiveness through the collective power of multiple specialized segments.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for alternating malware classifiers in an attempt to frustrate brute-force malware testing may include (1) providing a group of heuristic-based classifiers for detecting malware, wherein each classifier within the group differs from all other classifiers within the group but has an accuracy rate that is substantially similar to all other classifiers within the group, (2) including the group of classifiers within a security-software product, and (3) alternating the security-software product's use of the classifiers within the group in an attempt to frustrate brute-force malware testing by (a) randomly selecting and activating an initial classifier from within the group and then, upon completion of a select interval, (b) replacing the initial classifier with an additional classifier randomly selected from within the group. Various other methods, systems, and computer-readable media are also disclosed.