Automated Cluster Description Generation for Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional clustering techniques require manual interpretation and are inefficient in generating minimal, high-fidelity signatures for malware detection, often resulting in false positives due to the inclusion of common features among all instances, and do not utilize non-cluster data effectively.

Innovation Solution

An automated method using optimization techniques, specifically an integer linear program, to generate a minimal set of features that uniquely define a cluster by processing both cluster and non-cluster data, ensuring the generated descriptions are both human and machine readable and reduce false positives.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If conventional clustering techniques are used with manual interpretation, then cluster data can be analyzed, but the process is inefficient and time-consuming

Engineering Contradiction:

Improvesignature generation efficiencyVSAvoidtime for visual review of cluster data

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The system performs automatic generation of cluster descriptions and signatures through the optimization module, eliminating the need for manual visual review by analysts. The system serves itself by automatically processing cluster data, identifying distinguishing features, and generating signatures without human intervention.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical manual process of visual review with an automated optimization algorithm. The integer linear program systematically evaluates features and determines minimal distinguishing sets, substituting human analytical work with computational optimization.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If conventional signature generation includes all cluster features, then comprehensive coverage is achieved, but false positives increase due to common features

Engineering Contradiction:

Improvesignature fidelityVSAvoidfalse positives in malware detection

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The optimization module extracts only the essential distinguishing features from the cluster data that are necessary to differentiate malware from benign files. By taking out and selecting only the minimal necessary features, the system avoids including common features that would cause false positives, thereby maintaining high reliability without harmful over-inclusion.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of starting with all features and removing unnecessary ones, the system inverts the approach by identifying and selecting only the distinguishing features that matter. The optimization formulation focuses on finding features that differentiate the cluster from non-cluster data, rather than filtering out common features from a comprehensive set.

Inventive Principle:

Principle #13The other way round (Inversion)

3Extent of automation

If manual interpretation of cluster data is performed, then human understanding is achieved, but the process lacks automation

Engineering Contradiction:

Improvesignature generation automationVSAvoidhuman review requirement

Core Design Contradiction:

Extent of automationVSEase of operation

Solution Approach 1:

The system automatically generates cluster descriptions and signatures through the optimization module without requiring human analysts to manually interpret cluster data. The system serves itself by processing the data, identifying features, and producing signatures autonomously, achieving full automation in the signature generation process.

Inventive Principle:

Principle #25Self-service

4Measurement precision

If comprehensive feature sets are used in signatures, then accurate cluster definition is achieved, but the signatures become complex and difficult to reason about

Engineering Contradiction:

Improvecluster definition accuracyVSAvoidsignature complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The optimization module extracts only the minimal necessary features required to accurately define the cluster and differentiate it from other data. By selecting only the essential distinguishing features rather than including all possible features, the system achieves accurate cluster definition while maintaining signature simplicity and interpretability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system applies partial action by including only the subset of features that are necessary for accurate cluster differentiation, rather than using all available features. This partial selection achieves the required measurement precision while avoiding the complexity that would result from using excessive features.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS10812496B2Automatic generation of cluster descriptions

Publication Date: 2020.10.20 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a method includes receiving data associated with a cluster at a computer and processing the data at the computer to automatically generate a description of the cluster. The data includes cluster data comprising data within the cluster and non-cluster data comprising a remaining set of the data. The description comprises a minimal set of features that uniquely defines the cluster to differentiate the cluster data from non-cluster data. An apparatus and logic are also disclosed herein.