Assembly Language Model for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malicious code detection methods, particularly signature-based detection, face limitations in identifying new and variant malicious codes due to their reliance on byte information and log data, making it difficult to accurately detect unknown files.
Innovation Solution
A method and apparatus utilizing an assembly language model for malicious code detection, which involves converting input files into assembly code, embedding instruction code sequences using a prelearned model, and employing a classification model to determine if the file is malicious, incorporating techniques like masked language models and next sentence prediction tasks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used, then detection speed is maintained, but detection accuracy for new and variant malicious codes deteriorates
Solution Approach 1:
The patent replaces traditional mechanical signature-matching mechanisms with AI-based assembly language analysis. Instead of comparing byte patterns and log data, the system converts malicious code into assembly language representations and uses pre-trained language models to analyze instruction sequences, enabling effective detection of new and variant malware through semantic understanding rather than pattern matching
Solution Approach 2:
The patent fundamentally changes the detection parameters from byte-level information and log data to assembly language instruction sequences. By transforming the input representation from raw binary data to structured assembly instructions, the system enables more effective analysis of code semantics and behavior patterns, improving both accuracy and adaptability to new threats
2Reliability
If byte information and log data are used for detection, then existing malicious codes can be identified, but new malicious codes cannot be accurately detected
Solution Approach 1:
The patent applies preliminary action by pre-training assembly language models using large datasets of instruction sequences before deployment. The pre-trained models learn semantic representations of legitimate and malicious code patterns in advance, enabling the system to quickly and accurately analyze new files without requiring retraining, thus maintaining reliability while improving adaptability to unknown threats
Solution Approach 2:
The patent introduces assembly language as an intermediary representation between raw binary code and detection analysis. This intermediary layer provides structured, human-readable instruction sequences that capture the semantic meaning of code operations, enabling more reliable and adaptable detection compared to direct analysis of byte patterns or log data
Data Source
AI summary
Disclosed herein a method and apparatus for detecting a malicious code based on an assembly language model. According to an embodiment of the present disclosure, there is provided a method for detecting a malicious code. The method comprising: generating an instruction code sequence by converting an input file, for which a malicious code is to be detected, into an assembly code; embedding the instruction code sequence by using a prelearned assembly language model for instruction code embedding and outputting an embedding result of the instruction code sequence; and detecting whether or not the input file is a malicious code, by using a prelearned malicious code classification model with the embedding result as an input.