Binary File API Profiling for Fast Unknown Malware Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems struggle with unknown malware files, either misclassifying them as benign or requiring human analysis, leading to security risks and delayed defensive actions.
Innovation Solution
A computer-implemented method that automatically secures systems by identifying the closest known malicious binary file (KMBF) through branch mapping and API profiling, and implementing a defense strategy based on the identified KMBF, while also addressing discrepant functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If unknown files are flagged for human analyst assessment, then classification accuracy is improved, but response time deteriorates due to delays in defensive action
Solution Approach 1:
The system performs self-assessment of unknown files through automatic classification into known malware families using AI/ML models, eliminating the need for human analyst intervention in routine cases. The system independently determines defensive actions based on automated classification results, enabling rapid response without sacrificing classification accuracy.
Solution Approach 2:
An automated classification system acts as an intermediary between file detection and human analyst assessment. This intermediary layer processes unknown files through AI/ML-based classification, routing only truly ambiguous cases to human analysts while handling routine classifications automatically, thus reducing response time while maintaining accuracy.
2Reliability
If systems are locked down during human analyst assessment, then security reliability is improved, but system functionality deteriorates due to unnecessary restrictions
Solution Approach 1:
Instead of complete system lockdown, the system applies partial defensive actions targeted specifically at the classified malware family. The AI/ML system determines the minimum necessary restrictions based on the classified threat, applying only relevant defensive measures while allowing unrelated system functions to continue operating normally.
Solution Approach 2:
Defensive actions are applied locally and specifically to the classified malware family rather than globally to the entire system. The system implements targeted restrictions based on the classification results, affecting only the specific threat vector identified while leaving other system functionalities intact and operational.
3Ease of manufacture
If AI/ML models are trained on known malware families only, then model training simplicity is improved, but adaptability to novel malware deteriorates
Solution Approach 1:
The system performs preliminary classification of novel malware by comparing against known malware families using AI/ML models. This preliminary action enables the system to handle unknown files by matching them to known patterns, providing a foundation for further analysis while maintaining simplicity in the initial classification stage.
Solution Approach 2:
The system incorporates feedback mechanisms where classification results and analyst assessments are used to continuously retrain and improve the AI/ML models. This feedback loop enables the models to adapt to novel malware patterns over time while maintaining the simplicity of training on structured malware family data.
Data Source
AI summary
A computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defence strategy comprising an action known to mitigate a known threat posed by a closest known malicious binary file (KMBF). The method further includes identifying the closest KMBF by comparing an SBF application programming interface (API) profile generated in respect of the SBF with respective KMBF API profiles generated in respect of each of a plurality of KMBFs, the SBF and KMBF API profiles being generated by: identifying any API calls in the respective binary file; and assigning each of said identified API calls to one of a plurality of API call categories defined by one or more actions known to be effective in mitigating one or more possible threats posed by the respective API call category.