Behavior-Based Malicious Code Detection Using Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious code detection technologies struggle to identify unknown or modified malicious codes, as they rely on pre-defined binary patterns and behavior rules, which are ineffective for detecting new or altered threats.
Innovation Solution
A behavior-based detection method that generates a feature vector from characteristic factor information collected during process execution, using machine learning algorithms to create models for malicious and normal files, enabling effective verification of malicious code presence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If binary pattern-based detection is used, then detection rate and detection time are improved for known malicious codes, but unknown and changed malicious codes cannot be detected
Solution Approach 1:
The patent transforms malicious code detection from static binary pattern matching to dynamic behavior analysis by changing the detection parameters from fixed code patterns to variable execution characteristics. The system collects multiple characteristic factors (file operations, registry operations, network operations, etc.) and generates feature vectors that capture the behavioral parameters of processes, enabling detection of both known and unknown malicious codes through machine learning models.
Solution Approach 2:
The patent replaces the mechanical binary pattern matching system with a machine learning-based behavioral analysis system. Instead of mechanically comparing fixed binary patterns, the system uses machine learning algorithms to analyze process behavior特征 vectors and automatically learn detection patterns, substituting rigid mechanical detection with adaptive intelligent detection that can generalize to unknown threats.
2Adaptability or versatility
If behavior-based detection with pre-defined rules is used, then malicious code detection capability is improved, but additional information collection is required for each new rule and correlation between processes and files remains unknown
Solution Approach 1:
The patent creates a universal detection framework that collects comprehensive characteristic factors once and uses them for multiple detection purposes. The system gathers file operations, registry operations, network operations, and other behavioral characteristics in a unified manner, then generates feature vectors that can be applied across different detection scenarios without requiring separate information collection for each rule, reducing overall system complexity.
Solution Approach 2:
The patent introduces feature vectors as an intermediary representation that bridges the gap between raw process execution data and detection rules. Instead of directly correlating processes with files using complex rules, the system transforms behavioral characteristics into standardized feature vectors that serve as a common language for analysis, simplifying the correlation process and enabling automated machine learning-based detection.
3Adaptability or versatility
If characteristic factor information is collected during process execution, then detection performance for unknown malicious codes is improved, but information collection and processing complexity increases
Solution Approach 1:
The patent extracts only the essential characteristic factors from the complex process execution environment, focusing on key behavioral aspects such as file operations, registry operations, network operations, and process creation. By selectively extracting relevant features rather than processing all possible data, the system maintains high detection capability while reducing processing complexity through targeted feature selection.
Solution Approach 2:
The patent transforms raw, unstructured process execution data into structured feature vectors with fixed dimensions, changing the parameter representation from variable and complex to standardized and manageable. This parameter transformation enables the use of efficient machine learning algorithms while maintaining the ability to capture complex behavioral patterns, balancing detection performance with processing feasibility.
Data Source
AI summary
A behavior-based malicious code detecting apparatus and method using multiple feature vectors is disclosed. A malicious code learning method may include collecting characteristic factor information when a training target process comprising a malicious code is executed, generating a feature vector for malicious code verification based on the collected characteristic factor information, learning the generated feature vector through a plurality of machine learning algorithms to generate a model of representing the malicious code and a model of representing a normal file, and storing the model of representing the malicious code and the model of representing the normal file generated through the learning.