Antivirus Scan Feature Vectors for Scalable Malware Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual malware analysis is inefficient and resource-intensive due to the large volume and variety of malware, and existing feature extraction methods are hindered by static obfuscation and limited in identifying higher-level features, making it difficult to keep pace with the ever-changing landscape of malicious software.
Innovation Solution
A system and method using neural networks to generate feature vectors from antivirus scan data, including preprocessing, pre-training, and fine-tuning modules to automate the extraction of features from antivirus scan reports, enabling efficient and accurate malware analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If manual feature extraction techniques are used on malware data, then feature extraction can be performed with simple methods, but it would be infeasible and would require large amounts of time and resources
Solution Approach 1:
The patent replaces manual feature extraction techniques with deep learning-based automatic feature extraction. The neural network model automatically learns and extracts features from malware data without requiring manual intervention, thereby substituting the mechanical manual process with an automated intelligent system that can handle large volumes of data efficiently.
Solution Approach 2:
The deep learning model performs self-service by automatically extracting features from malware data without human intervention. The system trains the model to autonomously identify and extract relevant features, eliminating the need for manual feature engineering and enabling scalable processing of malware datasets.
2Ease of operation
If existing feature extraction methods are used, then the process can be straightforward, but they are hindered by static obfuscation and restricted to a single file format
Solution Approach 1:
The patent implements a universal feature extraction system based on deep learning that can process multiple file formats (PE, ELF, Mach-O) and handle various obfuscation techniques. The neural network model is designed to be format-agnostic and can adapt to different malware types, making the system versatile and multi-functional rather than restricted to单一 format.
Solution Approach 2:
The system employs dynamic feature extraction where the neural network adapts its feature extraction process based on the input characteristics. The model can dynamically adjust to different file formats and obfuscation methods, making the extraction process flexible and adaptable rather than static and rigid.
3Device complexity
If existing feature extraction methods are used, then implementation can be simple, but they are limited in their capacity to identify higher-level malware features
Solution Approach 1:
The patent replaces simple feature extraction methods with deep learning-based automatic feature extraction. The neural network model automatically learns and extracts features from malware data without requiring manual intervention, thereby substituting the mechanical manual process with an automated intelligent system that can handle large volumes of data efficiently.
Solution Approach 2:
The patent transitions from traditional shallow feature extraction to deep feature extraction by introducing multiple layers of neural networks. This dimensional transformation enables the system to capture higher-level abstract features and semantic patterns that are not accessible through conventional single-layer extraction methods.
Data Source
AI summary
Provided are methods, systems, and non-transitory computer-readable media for generating a feature vector for malware, including storing, in memory of a computing device, program code for a trained neural network that produces embedded representations for antivirus scan data; executing, by a processor of the computing device, the program code for the trained neural network to perform the operations of: (a) receiving an antivirus scan report (AVSR) for a malware file; (b) normalizing each label in the AVSR by separating the label into a sequence of tokens including a set of token strings; (c) embedding a first token and plural second tokens to generate an input sequence for the malware file; (d) inputting the input sequence into a neural model for producing antivirus scan data; and (e) outputting the antivirus scan data produced by the neural model as one or more feature vectors.