Cloud ML for Malicious PE File Detection via Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Machine Learning (ML) methods for detecting malicious Portable Executable (PE) files require large training datasets and lengthy training cycles, leading to high costs and low agility in model updates, resulting in suboptimal or inefficient detection processes.
Innovation Solution
A cloud-based system utilizing a trained machine learning model that leverages knowledge features associated with PE files, enabling inline monitoring of production traffic, efficient model distribution, and rapid retraining based on production data, significantly reducing training time and dataset size while improving accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional machine learning methods are used for detecting malicious PE files, then detection capability is achieved, but training time and dataset size requirements are excessively large
Solution Approach 1:
The patent extracts and utilizes static properties and structural features from PE files that are inherently informative about malicious behavior. By focusing on extracted features such as imports, exports, sections, and headers rather than training on raw byte data, the system achieves high detection accuracy with significantly reduced training time and data requirements.
Solution Approach 2:
The patent performs preliminary feature extraction and analysis on PE files to identify characteristic patterns and structures before detection. By pre-processing and extracting meaningful features from the executable format structure, the system prepares data in a form that requires minimal training while maintaining high detection precision.
2Measurement precision
If conventional machine learning methods are used for detecting malicious PE files, then detection capability is achieved, but training dataset size requirements are excessively large
Solution Approach 1:
The patent extracts structured features from PE files including imports, exports, sections, headers, and other format-specific elements. This feature extraction transforms raw binary data into meaningful characteristics that convey rich information about file behavior and intent, enabling accurate detection with far fewer training samples.
Solution Approach 2:
The patent changes the representation parameters of PE files from raw byte sequences to structured feature vectors based on the PE format specification. By transforming the data representation to expose meaningful parameters and characteristics inherent in the executable format, the system achieves high detection accuracy with reduced data requirements.
3Adaptability or versatility
If conventional machine learning methods are used for detecting malicious PE files, then detection capability is achieved, but model update agility is low
Solution Approach 1:
The patent performs preliminary feature extraction and establishes a detection framework based on PE structure characteristics that can be quickly retrained. By pre-defining meaningful features and using an optimized training approach, the system enables rapid model updates when new threat patterns emerge, significantly improving adaptability.
Solution Approach 2:
The patent implements a dynamic detection system where the machine learning model can be efficiently retrained and updated based on new data. The feature extraction pipeline and model architecture are designed to accommodate rapid retraining, allowing the system to adapt to evolving threats without extensive reoptimization.
Data Source
AI summary
Systems and methods include performing inline monitoring of production traffic between users, the Internet, and cloud services via a cloud-based system; utilizing a trained machine learning model to inspect static properties of files in the production traffic; and classifying the traffic as one of malicious or benign based on the trained machine learning model.