Automatic Binary Segmentation for Analysis-Resistant Content
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antimalware applications struggle to analyze binary content that is resistant to analysis, such as encrypted, compressed, or corrupted files, limiting their ability to detect malware in these types of content.
Innovation Solution
Implementing a machine learning-based binary segmentation method to identify and render analysis-resistant data segments, using techniques like decryption and decompression to analyze these segments for potential malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional machine learning approaches are used to train malware detection models, then the models can effectively recognize known malware patterns, but they fail to analyze binary content that is resistant to analysis (encrypted, compressed, or corrupted files)
Solution Approach 1:
The binary content is divided into multiple data segments using a machine learning-based segmentation model that identifies boundaries between different data types. This segmentation allows the system to process analysis-resistant content in manageable portions, applying appropriate rendering techniques to each segment to make it analyzable for malware detection
Solution Approach 2:
The system applies rendering techniques (decryption, decompression, or correction) to data segments before analyzing them for malware. This preliminary action transforms the analysis-resistant content into a form that can be effectively analyzed by the malware detection model, resolving the contradiction between handling resistant files and maintaining analysis reliability
2Measurement precision
If the dataset contains mostly known executable files with malware history, then the ML tool can predict maliciousness of those files, but it cannot analyze files that are resistant to analysis
Solution Approach 1:
The system introduces an intermediary rendering process that acts as a bridge between analysis-resistant binary content and the malware detection model. The rendering techniques (decryption, decompression, correction) transform the resistant content into a format suitable for the existing ML model, allowing the model to maintain its high prediction accuracy while extending its capability to handle previously unanalyzable files
Data Source
AI summary
Methods, apparatuses and systems for automatic binary file segmentation include receiving binary content, applying a first machine learning process to the binary content to determine data segments in the binary content by identifying at least one of a respective starting point or end point of different data types in the binary content, examining the determined data segments of the binary content to identify data segments that are resistant to analysis, and applying respective techniques to the identified, analysis-resistant data segments to render the content of the identified, analysis-resistant data segments. In some embodiments, the rendering of the content of the identified, analysis-resistant data segments enables the identified, analysis-resistant segments to be analyzed, for example, to determine if the identified, analysis-resistant segments contain malicious content.