Application Classification via Local Model Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face high computational burdens and increased errors due to repeated requests for categorizing applications, leading to inefficiencies in detecting malicious applications.
Innovation Solution
A method and system that gather attributes of applications, such as file numbers, executable files, permissions, and classes, to classify them using a trained model, with heuristic rules determining categories like malicious, unwanted, or trusted, reducing the need for remote infrastructure and minimizing errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If caching services are used to remember results of previously performed tasks, then the computing burden on remote infrastructure is reduced, but the error rate increases
Solution Approach 1:
The system performs preliminary classification of applications into categories (malicious, unwanted, trusted) before they are executed on the device. By categorizing applications in advance using a trained classification model, the system reduces the need for repeated remote analysis while maintaining accurate detection. This preliminary action allows caching of category results without significantly increasing error rates, as the classification is based on multiple attributes analyzed beforehand.
2Reliability
If multiple antivirus applications are hooked up to a remote server, then detection capability is improved, but the burden on remote infrastructure increases
Solution Approach 1:
The system segments the antivirus detection process by distributing classification models to individual devices rather than concentrating all analysis on a remote server. Each device runs its own trained classification model locally, enabling independent categorization of applications. This segmentation reduces the burden on remote infrastructure while maintaining detection capability across multiple devices, as each device performs classification autonomously using its local model.
3Speed
If identical tasks are performed repeatedly on remote infrastructure, then real-time analysis is maintained, but computational resources are wasted
Solution Approach 1:
The system performs classification analysis in advance when applications are installed or updated, categorizing them before they need to be analyzed again. The results of this preliminary classification are stored locally on the device. When the same application is encountered again, the system retrieves the pre-computed category instead of repeating the full analysis, thereby maintaining real-time response while avoiding redundant computational work.
4Loss of time
If caching services are used to store classification results, then response time is improved, but classification accuracy deteriorates
Solution Approach 1:
The system incorporates feedback mechanisms where classification results are continuously evaluated and the classification model is retrained using newly labeled data. When uncertainties are detected or new patterns emerge, the system updates the model to improve accuracy. This feedback loop ensures that cached classification results remain accurate over time, as the underlying model adapts to new threats and patterns while maintaining the performance benefits of caching.
Data Source
AI summary
Disclosed herein are systems and methods for categorizing an application on a computing device including gathering a set of attributes of an application. The set of attributes of the application includes at least one of: a number of files in an application package of the application; a number of executable files in the application package; numbers and types of permissions being requested; a number of classes in the executable files in the application package; and a number of methods in the executable files in the application package. sending the gathered set of attributes to a trained classification model. The application is classified, using the classification model, based on the gathered set of attributes by generating one or more probabilities of the application belonging to respective one or more categories of applications. A category of the application is determined based on the generated one or more probabilities.