Automated Zero-Day Malware Detection With File-Type Classifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current signature-based malware detection systems are ineffective against zero-day threats, requiring extensive resource allocation and time to generate signatures, and class-matching detectors suffer from high false-alarm rates and inefficiency.
Innovation Solution
A system and method utilizing a composite classifier that partitions files into categories based on external attributes, employs category-specific classifiers, and incorporates an extensible feature vector generator (EFVG) and qualified meta-features (QMF) for improved malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used, then known malware can be identified accurately, but zero-day malware cannot be detected and resources are wasted generating signatures
Solution Approach 1:
The detection system segments malware detection into two independent stages: file typing (identifying malware family) and classification (distinguishing benign vs malicious). This segmentation allows the system to use different approaches for each stage - statistical models for typing and machine learning for classification - thereby improving both accuracy for known malware and capability for zero-day detection.
Solution Approach 2:
The patent replaces the mechanical signature-matching approach with a statistical and machine learning-based system. Instead of relying on exact byte-pattern matching, the system uses statistical models to determine file types and machine learning classifiers to identify malware, enabling detection of previously unknown threats while maintaining accuracy.
2Adaptability or versatility
If class-matching detectors are used, then zero-day threats can be detected, but false-alarm rates increase and operational efficiency decreases
Solution Approach 1:
By segmenting the detection process into file typing and classification stages, the system reduces false alarms. The file typing stage uses statistical models that are less prone to false positives, and the classification stage uses machine learning on selected features, thereby improving overall reliability while maintaining zero-day detection capability.
Solution Approach 2:
The system changes the parameters used for detection by selecting specific features (n-grams, statistical properties) and adjusting classification thresholds. This parameter optimization reduces false-alarm rates while maintaining the ability to detect zero-day malware effectively.
3Adaptability or versatility
If extensive resources are dedicated to generating malware signatures, then detection coverage increases, but time consumption increases
Solution Approach 1:
The system performs preliminary file typing to categorize malware into families before classification. This preliminary action enables the system to use family-specific classification models, reducing the time needed for analysis while maintaining comprehensive coverage through the hierarchical classification structure.
Solution Approach 2:
The patent replaces the time-consuming manual signature generation process with automated statistical modeling and machine learning. The system automatically learns file type characteristics and malware patterns from training data, eliminating the need for manual signature creation while maintaining extensive detection coverage.
Data Source
AI summary
Improved systems and methods for automated machine-learning, zero-day malware detection. Embodiments include a system and method for detecting malware using multi-stage file-typing and, optionally pre-processing, with fall-through options. The system and method receive a set of training files which are each known to be either malign or benign, partition the set of training files into a plurality of categories based on file-type, in which the partitioning file-types a subset of the training files into supported file-type categories, train file-type specific classifiers that distinguish between malign and benign files for the supported file-type categories of files, associate supported file-types with a file-type processing chain that includes a plurality of file-type specific classifiers corresponding to the supported file-types, train a generic file-type classifier that applies to file-types that are not supported file-types, and construct a composite classifier using the file-type specific classifiers and the generic file-type classifier.