Antimalware Model Training from Weighted External Malware Consensus
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware (AM) applications rely on machine learning models that are limited by the number of files analyzed, leading to missed detections of malicious code due to insufficient training data.
Innovation Solution
A system and method that utilizes a weighted consensus algorithm to compare hashes of Internet files against external malware and antiviral databases, updates an internal database, and trains a machine learning algorithm using the file's status determination to create a labeled data set, employing vector-based hashing techniques like Locality Sensitive Hashing, SimHash, and MinHash to identify similar malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning models are trained using only internally analyzed files, then training data volume is limited, but detection accuracy improves due to curated quality
Solution Approach 1:
The patent combines multiple external malware databases and external antiviral databases into a unified training dataset, merging their respective strengths to create a comprehensive training corpus that increases data volume while maintaining quality through systematic integration
Solution Approach 2:
The system creates a multi-functional training framework that accepts and processes data from diverse sources including malware databases, antiviral databases, and internal analysis results, making the training system universally applicable to various data formats and sources
2Measurement precision
If traditional signature-based detection is used, then known malware can be detected accurately, but new or obfuscated malware variants are missed
Solution Approach 1:
The system performs preliminary training of machine learning models using comprehensive datasets from multiple sources before deployment, preparing the models in advance to recognize patterns in both known and novel malware variants, enabling them to adapt to new threats without retraining
Solution Approach 2:
The patent transforms malware detection from exact signature matching to pattern recognition by changing the detection parameters from precise hash matching to probabilistic similarity assessment, allowing detection of obfuscated variants that maintain underlying code patterns
3Reliability
If multiple external databases are queried for each file, then detection comprehensiveness improves, but processing time increases
Solution Approach 1:
The system performs preliminary queries to external malware and antiviral databases during offline periods or batch processing, pre-fetching and caching detection results that can be quickly referenced during online file analysis, reducing real-time processing delays
Solution Approach 2:
The patent implements a tiered querying approach where not all external databases are queried for every file, but rather a subset is selected based on file characteristics, threat levels, and available resources, performing partial action to balance comprehensiveness with efficiency
Data Source
AI summary
Systems and methods for computer security are provided by a processor programmed to: receive an Internet file and produce a hash of the Internet file; compare the hash to external malware databases and external antiviral databases for a file match to determine the Internet file's status that is based upon a weighted consensus algorithm derived from the external malware databases and the external antiviral databases; check if the Internet file's status determination matches the internal software database Internet file's status and update the internal software database based upon the Internet file's status determination if a threshold for the weighted consensus algorithm is exceeded; and train a machine learning algorithm using the Internet file's status determination to create a labeled data set based upon the Internet file's status determination, and provide a report via the input/output device based upon the Internet file's status determination.