Behavior Inference Model for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection mechanisms rely on signature-based comparison, which can only detect known malicious programs and may fail to prevent damage or data theft during early execution, as they require feature extraction during execution to determine if an application is malicious.
Innovation Solution
A behavior inference model is built using a word embedding model and a Generative Adversarial Network (GAN) to convert program operation sequences into word vectors, generate inference vectors, perform real/fake discrimination, and optimize the GAN model to predict subsequent program operations, thereby preventing file damage and data theft.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based comparison is used for malware detection, then detection accuracy for known malware is improved, but detection capability for unknown malware in early execution period deteriorates
Solution Approach 1:
The system performs preliminary action by training the behavior inference model in advance using historical program operation sequences. The model learns normal and malicious behavior patterns before actual malware detection is needed, enabling it to make accurate predictions during early execution without requiring time-consuming feature extraction or signature matching
2Reliability
If feature extraction during execution is performed, then malware detection capability is improved, but prevention capability in early execution period deteriorates
Solution Approach 1:
The system extracts behavioral features in advance during the model training phase rather than during execution. The behavior inference model is pre-trained on大量 program operation sequences to learn meaningful features, so during actual detection it can directly infer malicious behavior from early execution traces without time-consuming feature extraction
Solution Approach 2:
The system replaces the mechanical feature extraction and signature matching process with a learned behavior inference model. Instead of manually extracting features during execution and comparing them against known signatures, the neural network model automatically infers malicious behavior from sequential operation patterns, enabling faster detection during early execution
Data Source
AI summary
A behavior inference model building apparatus and a behavior inference model building method thereof are provided. The behavior inference model building apparatus converts a plurality of program operation sequences of a plurality of program operation sequence data into a plurality of word vectors through a word embedding model, and inputs the first M word vectors of the word vectors, corresponding to each program operation sequence data, into a generative adversarial network (GAN) model to train and optimize the GAN model. The behavior inference model building apparatus integrates the word embedding model and the generator of the optimized GAN model to build a behavior inference model.