Antivirus Scan Feature Vectors for Scalable Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual malware analysis is inefficient and resource-intensive due to the large volume and variety of malicious files, and existing feature extraction methods are hindered by static obfuscation and limited in identifying higher-level features, making it difficult to keep pace with the ever-changing landscape of malware.
Innovation Solution
A neural network-based system that processes antivirus scan data to generate feature vectors by normalizing and embedding tokens from antivirus scan reports, allowing for automated malware analysis and feature extraction, even from unseen files, using a single GPU for reduced computational requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual malware analysis is used, then analysis accuracy may be maintained, but productivity is severely reduced due to the large volume and variety of malicious files
Solution Approach 1:
The system enables automated malware analysis where the neural network model independently processes antivirus scan reports and generates feature vectors without human intervention. The model self-learns from training data and automatically applies knowledge to classify new malware samples, eliminating the need for manual analysis while maintaining high throughput.
Solution Approach 2:
The patent replaces manual mechanical analysis processes with an automated neural network-based system. The mechanical process of human experts examining malware is substituted by computational processing of antivirus scan reports through trained neural networks, achieving both speed and scalability.
2Measurement precision
If existing feature extraction methods are used, then some features can be extracted, but the methods are hindered by static obfuscation and limited in identifying higher-level features
Solution Approach 1:
The system transforms the feature extraction approach by changing parameters from static, predefined features to dynamic, learned representations. The neural network model processes raw antivirus scan report text and automatically learns relevant features and patterns, adapting to different malware types and obfuscation techniques without requiring manual feature engineering.
Solution Approach 2:
The feature extraction process becomes dynamic through the neural network model that can adapt its feature identification capabilities based on the input data. The model learns to identify higher-level features and patterns that are not static or predefined, enabling it to handle diverse and evolving malware obfuscation techniques.
3Measurement precision
If manual feature extraction techniques are applied to large quantities of malware data, then comprehensive feature analysis may be achieved, but the process becomes infeasible and requires large amounts of time and resources
Solution Approach 1:
The patent replaces manual feature extraction mechanics with automated neural network processing. The system processes large volumes of antivirus scan reports through computational operations, achieving both comprehensive feature extraction and high processing speed that is infeasible for manual analysis.
Solution Approach 2:
The neural network model serves multiple functions: it processes diverse input formats from different antivirus products, automatically extracts various types of features, and adapts to different malware families. This universal approach eliminates the need for separate manual extraction processes for different malware types.
4Measurement precision
If more computational resources are allocated for malware analysis, then analysis depth may be improved, but the cost and complexity of the system increases
Solution Approach 1:
The system uses copies of antivirus scan reports as input to the neural network model, eliminating the need for complex infrastructure to handle original malware files. The model processes text-based representations that can be replicated and distributed without requiring substantial computational resources or complex hardware configurations.
Data Source
AI summary
Provided are methods, systems, and non-transitory computer-readable media for generating a feature vector for malware, including storing, in memory of a computing device, program code for a trained neural network that produces embedded representations for antivirus scan data; executing, by a processor of the computing device, the program code for the trained neural network to perform the operations of: (a) receiving an antivirus scan report (AVSR) for a malware file; (b) normalizing each label in the AVSR by separating the label into a sequence of tokens including a set of token strings; (c) embedding a first token and plural second tokens to generate an input sequence for the malware file; (d) inputting the input sequence into a neural model for producing antivirus scan data; and (e) outputting the antivirus scan data produced by the neural model as one or more feature vectors.