Byte-Based AI File Classification for Obfuscated Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity platforms struggle with suboptimal prediction performance in classifying malware-infected binary files due to reliance on tree-based AI models that impose limiting modalities and require manual feature engineering, failing to adapt to evolving obfuscation and malware techniques.
Innovation Solution
A transformer-based byte-based AI model that directly operates on file bytes, automates feature extraction, and allows for continuous learning, deployed either in the cloud or locally, to identify malicious code without imposing modality or encoding, and can be compressed for endpoint deployment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If tree-based AI models are used for binary file classification, then the system can operate with conventional architectures, but the prediction performance becomes suboptimal and the model requires manual feature engineering
Solution Approach 1:
The transformer-based model automatically performs feature extraction from raw binary file bytes without requiring manual feature engineering. The model self-adapts to evolving malware techniques through its attention mechanisms, eliminating the need for human experts to continuously update feature sets while maintaining high prediction accuracy.
Solution Approach 2:
The patent replaces traditional tree-based mechanical classification systems with a transformer-based neural network that processes binary data through learned representations. This substitution enables the system to capture complex patterns in malware that tree-based models miss, improving prediction performance while reducing reliance on manually engineered features.
2Adaptability or versatility
If transformer-based models operate on raw file bytes without encoding, then adaptability to new malware techniques improves, but computational complexity increases
Solution Approach 1:
The transformer model segments the binary file into fixed-size chunks or tokens, processing them in manageable units. This segmentation allows the model to handle long binary sequences efficiently while maintaining adaptability to new malware patterns, reducing the computational burden compared to processing entire files as single units.
Solution Approach 2:
The model changes parameters such as sequence length, chunk size, and batch processing configurations to balance computational complexity with adaptability. By adjusting these parameters, the system can process raw binary bytes effectively without overwhelming computational resources, maintaining versatility against new obfuscation techniques.
3Measurement precision
If the AI model is deployed in the cloud, then computational resources are abundant, but latency in threat detection increases
Solution Approach 1:
The patent deploys the model across multiple dimensional layers: a compressed lightweight version runs locally at the network sensor for immediate threat detection, while a full-precision version operates in the cloud for comprehensive analysis. This multi-dimensional deployment strategy reduces latency for common threats while maintaining high detection accuracy through cloud-based verification and continuous learning.
Solution Approach 2:
The network sensor acts as an intermediary between endpoints and the cloud-based AI model. It performs preliminary filtering and processing of binary files locally, sending only suspicious or uncertain files to the cloud for detailed analysis. This intermediary approach reduces cloud communication overhead and detection latency while maintaining accurate threat identification.
4Adaptability or versatility
If model compression is applied for endpoint deployment, then deployment flexibility improves, but model accuracy may deteriorate
Solution Approach 1:
The patent applies partial compression techniques that retain the most critical model components for endpoint deployment. Rather than fully compressing the model, it preserves key transformer layers and feature extraction capabilities while reducing overall model size, achieving a balance between deployment flexibility and maintained accuracy for threat detection.
Solution Approach 2:
The compressed model retains high-quality feature extraction capabilities locally at the endpoint while offloading more computationally intensive processing to the cloud. This local quality approach ensures that essential detection accuracy is maintained at the edge, with the understanding that some advanced analysis occurs in the cloud environment.
Data Source
AI summary
A method of monitoring an endpoint for malicious code includes deploying an artificial intelligence (AI) model to a endpoint protection system, the AI model trained on a plurality of executable code files in byte form, monitoring a target system for execution of a target executable file. The method further includes analyzing, by the AI model, the target executable file in the byte form of the target executable file and determining, based on an output of the AI model, a decision variable for the target executable file.