Antimalware Model Training via Binary Structure Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data augmentation techniques are challenging in Antimalware (AM) solutions due to the difficulty in manipulating binary code, limiting the diversity of training data for AM machine learning models.
Innovation Solution
The method involves modifying the binary structure of known malicious and benign files through decompiling, reverse engineering, and recompiling with different compiler options or compilers, creating a larger dataset that maintains functional equivalence while enhancing the accuracy of the machine learning model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If data augmentation techniques are applied to binary files, then the diversity of training data is improved, but the complexity of manipulating binary code increases
Solution Approach 1:
The patent introduces an intermediary process between the original binary files and the training data. It decompiles binary files into intermediate representations (such as control flow graphs or abstract syntax trees), applies transformations to these intermediate forms, and then recompiles them. This intermediary representation makes the manipulation process more manageable and systematic, resolving the contradiction between data diversity and manipulation complexity.
Solution Approach 2:
The patent segments the binary file manipulation process into distinct phases: decompilation, transformation, and recompilation. By breaking down the complex task of binary code manipulation into smaller, manageable segments, the system can apply diverse transformations while keeping each individual step relatively simple and controlled.
2Measurement precision
If the training dataset is expanded through binary modification, then the accuracy of the machine learning model is improved, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by decompiling binary files into intermediate representations once, and then applying multiple transformations to these intermediate forms to generate diverse training samples. This approach avoids the need to repeatedly compile from source code for each transformation, significantly reducing processing time while maintaining model accuracy.
3Ease of operation
If simple binary manipulation techniques are used, then the ease of operation is improved, but the functional equivalence of modified files cannot be guaranteed
Solution Approach 1:
The patent uses intermediate representations (control flow graphs, abstract syntax trees) as mediators that preserve the semantic meaning of the original code. These intermediate forms provide a structured view that maintains functional relationships, allowing transformations to be applied while guaranteeing that the modified files remain functionally equivalent to the originals.
Data Source
AI summary
Systems and methods for data augmentation used in training an anti-malware (AM) machine learning model are provided herein. In some embodiments, a method for data augmentation may include receiving a first plurality of binary files each having a first binary structure, wherein the first plurality of binary files include one or more known malicious and benign files; modifying the binary structure of each of the first plurality of binary files to produce a second plurality of binary files each having a second binary structure that is different from the first binary structure; using the first and second plurality of binary files to train an AM machine learning model as to which files are malicious and which files are benign; and using the trained AM machine learning model to identify new malicious files.