Binary Structure Variation Through Recompilation for Malware Model Training
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data augmentation techniques are challenging to apply in Antimalware (AM) solutions due to the complexity of binary code, which limits the diversity of training data for anti-malware machine learning models.
Innovation Solution
The method involves receiving binary files, modifying their structure by decompiling and recompiling with different compiler options or using binary code analysis to extract and modify compilation instructions, thereby creating a larger dataset with structurally different but functionally equivalent files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If traditional data augmentation techniques (cropping, padding, flipping) are used, then training data diversity increases, but these techniques are ineffective for binary code files
Solution Approach 1:
The patent changes the parameters of binary files by decompiling them to source code, modifying compilation parameters (optimizer choices, compilation levels, flags), and recompiling to generate structurally varied but functionally equivalent binaries. This transforms the binary structure parameters while preserving functional behavior, enabling effective data augmentation for malware detection training.
Solution Approach 2:
The patent creates copies of original binary files through a multi-step process: decompiling to source code, recompiling with different parameters to generate variant copies. These copied files maintain functional equivalence while exhibiting structural differences, providing diverse training samples without requiring additional malicious samples.
2Quantity of substance
If binary files are decompiled and recompiled with different options, then dataset size and structural diversity increase, but the processing complexity increases
Solution Approach 1:
The patent performs preliminary decompilation of binary files to source code upfront, creating an intermediate representation that can be efficiently reused. Once decompiled, the same source code can be compiled multiple times with different parameters to generate numerous variant binaries, avoiding repeated decompilation and reducing overall processing complexity.
Solution Approach 2:
The patent segments the data augmentation process into distinct stages: decompilation to source code, parameter selection for compilation, and recompilation with different options. This segmentation allows each stage to be optimized independently and enables parallel processing of multiple compilation variants from a single decompiled source.
Data Source
AI summary
A method, apparatus and system for data augmentation include receiving a first plurality of binary files each having a first binary structure and including one or more known files containing malicious content and one or more known files not containing malicious content, altering a source code of each of the first plurality of binary files to produce a second plurality of binary files each having a second binary structure that is different from the first binary structure, wherein each altered binary file is functionality similar to the corresponding file in the first plurality of binary files from which it was produced, using the first and second plurality of binary files to train the AM machine learning model to distinguish between binary files containing malicious content and binary files not containing malicious content, and applying the trained AM machine learning model to identify unknown binary files containing malicious content.