Centroid-Based File Classification for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file classification systems are often over-inclusive or under-inclusive, improperly classifying clean files as malicious or vice versa, leading to inefficiencies in detecting and identifying malicious software.
Innovation Solution
The use of centroids in a coordinate space to classify files, where files are mapped based on attributes and classified as malicious or not malicious by determining their location within defined geometric regions, with centroids redefined to improve accuracy and reduce misclassification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If simple file classification systems are used, then computational resources are conserved, but classification accuracy deteriorates leading to false positives and negatives
Solution Approach 1:
The coordinate space is divided into multiple portions with different classification functions. Some portions use simple classification for computational efficiency, while other portions use more complex centroid-based analysis for improved accuracy. This segmentation allows the system to apply computational resources selectively based on the specific region of the coordinate space being analyzed.
Solution Approach 2:
The patent introduces an additional dimension of analysis by defining centroids in the coordinate space and measuring distances from files to these centroids. This transforms the classification from a simple boundary-based approach to a distance-based approach in an extended dimensional space, improving accuracy without proportionally increasing computational complexity.
2Device complexity
If simple file classification systems are used, then system complexity is reduced, but misclassification of files increases
Solution Approach 1:
Centroids are pre-defined in the coordinate space based on clusters of files with known characteristics. This preliminary action allows the classification system to quickly compare new files against pre-established reference points, improving reliability without requiring complex real-time analysis. The centroids serve as pre-computed anchors that guide the classification decision.
Solution Approach 2:
The patent replaces complex mechanical classification boundaries with a geometric distance-based system. Instead of using intricate decision boundaries that are difficult to implement and maintain, the system uses simple distance calculations from file attributes to centroid positions, substituting a simpler geometric mechanism for a complex mechanical classification system.
3Measurement precision
If centroids are defined to improve classification accuracy, then false positives and negatives are reduced, but computational complexity increases
Solution Approach 1:
Different portions of the coordinate space are assigned different levels of classification complexity. Centroids are strategically placed in regions where they provide the most value for improving accuracy. The system applies centroid-based classification locally in specific regions rather than uniformly across the entire coordinate space, optimizing the balance between accuracy improvement and computational complexity.
Data Source
AI summary
Centroids are used for improving machine learning classification and information retrieval. A plurality of files are classified as malicious or not malicious based on a function dividing a coordinate space into at least a first portion and a second portion such that the first portion includes a first subset of the plurality of files classified as malicious. One or more first centroids are defined in the first portion that classify files from the first subset as not malicious. A file is determined to be malicious based on whether the file is located within the one or more first centroids.