Attention-Based Malware Detection From API Behavior Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods struggle to reliably identify malicious software due to camouflage and the rapid growth of applications, making it difficult for end users to detect and classify malware without user interaction, and existing systems often require execution in unsecured environments, risking contamination.
Innovation Solution
A method using a neural network-based classifier with an attention mechanism to analyze behavior sequences, such as API-calls, to identify malware, focusing on significant subsequences for classification, and incorporating expert feedback for supervised learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection methods are used, then the detection process is simple, but the detection accuracy is low due to malware camouflage and rapid application growth
Solution Approach 1:
The behavior sequence is divided into multiple subsequences, and the classification is performed on these segmented parts rather than the entire sequence at once. This segmentation allows the system to focus on relevant portions of the behavior sequence that are indicative of malware, thereby improving detection accuracy while managing complexity through localized analysis.
Solution Approach 2:
An attention mechanism is introduced as an intermediary component between the behavior sequence and the classifier. This attention mechanism automatically identifies and weights the most relevant subsequences, acting as a mediator that filters and prioritizes information before it reaches the classification stage, thus improving accuracy without requiring manual complexity management.
2Reliability
If the entire behavior sequence is analyzed for classification, then comprehensive detection is achieved, but the data processing load and time consumption increase significantly
Solution Approach 1:
Instead of analyzing the entire behavior sequence, the system applies partial action by focusing only on the most relevant subsequences identified through the attention mechanism. This partial analysis maintains classification reliability by concentrating computational resources on the most informative parts of the sequence, thereby reducing overall analysis time without sacrificing detection accuracy.
Solution Approach 2:
The attention mechanism extracts and isolates the most relevant subsequences from the full behavior sequence, separating the critical information from the less important parts. This extraction process allows the classifier to work with a reduced, high-value subset of data, maintaining reliability while significantly reducing processing time and computational load.
3Measurement precision
If expert verification of classification results is implemented, then detection accuracy improves, but the process requires more user interaction and time
Solution Approach 1:
The system partially automates the expert verification process by using the attention mechanism to pre-identify and present only the most relevant subsequences to experts for verification. This self-service approach filters out less important information before it reaches the expert, reducing the time and effort required for verification while maintaining improved accuracy through targeted expert review.
Solution Approach 2:
The attention mechanism performs preliminary action by pre-processing and prioritizing the behavior sequence before it reaches the expert verification stage. It automatically identifies and highlights the most relevant subsequences, so when experts do verify the results, they are already focused on the critical portions, thereby improving accuracy without proportionally increasing the time and interaction required.
4Measurement precision
If neural network-based classification is used, then detection accuracy improves, but the computational requirements and system complexity increase
Solution Approach 1:
The neural network processes segmented subsequences rather than the entire behavior sequence at once. This segmentation reduces the computational burden on the neural network at each processing step, allowing high accuracy to be achieved through multiple focused processing passes on smaller data chunks rather than a single pass on the complete sequence, thereby managing energy consumption more efficiently.
Solution Approach 2:
The attention mechanism serves as an intermediary that pre-filters and weights the input data before it reaches the neural network. By providing the neural network with already-prioritized, relevant subsequences, the attention mechanism reduces the computational energy required for the neural network to process irrelevant or less important information, while still achieving high classification accuracy on the critical data.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Apparatuses and methods for determining if a computer program is malware and to which malware class it belongs to. In the method the behaviour of a computer program is traced by observing the activity of the program. Behaviour sequences comprising API-calls or similar activity of a computer program are then provided into a classifier for classifying the computer program. From the outcome of the classifier a classification result and the portions relevant to decision can be provided to a person for further confirmation.