CNN File Classification from Truncated Bytes Using KAN Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques rely on file extensions, which can be unreliable as they do not accurately reflect the file contents, leading to ineffective classification of malicious scripts.
Innovation Solution
A convolutional neural network (CNN) architecture incorporating a Kolmogorov-Arnold Network (KAN) layer is trained using a combined cost function of cross-entropy and contrastive loss to classify files based on reduced-size versions, specifically the first N bytes, to enhance accuracy and efficiency in file type classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file extension is used for classification, then classification speed is fast, but classification accuracy deteriorates because file extensions can be changed regardless of file contents
Solution Approach 1:
The patent extracts only the first N bytes (header portion) from each file to create a reduced-size training dataset. This extraction approach enables the CNN to learn from file content characteristics without processing entire files, achieving accurate classification while maintaining efficiency. The reduced-size files contain sufficient discriminatory features for file type identification.
Solution Approach 2:
The patent creates reduced-size copies of original files for training purposes. These compressed representations retain the essential characteristics needed for accurate file type classification while being much smaller in size, allowing the model to learn effectively without the computational burden of full-file processing.
2Productivity
If reduced-size files are used for training, then training efficiency is improved, but classification accuracy may deteriorate due to loss of information
Solution Approach 1:
The patent optimizes the parameter N (number of bytes to retain) to find the optimal balance between file size reduction and information retention. By adjusting this parameter, the system achieves both training efficiency and high classification accuracy, as the optimal N value preserves sufficient discriminatory features while reducing overall file size for faster processing.
Data Source
AI summary
Files are classified by file type based on reduced-size representations of the file contents (e.g., truncated versions of files) using a trained convolutional neural network (CNN). The CNN architecture includes a hidden layer comprising a Kolmogorov-Arnold Network (KAN) layer in lieu of a traditional fully connected layer. Training of the CNN employs a cost function that combines cross-entropy loss and contrastive loss for evaluating CNN performance. Training of the CNN is also incremental-when training a CNN for the task of classifying reduced-size files, the CNN is first trained on a training dataset comprising files of their original sizes. Once this initial phase of training is complete, the trained CNN is fine-tuned as a result of one or more additional phases of training, where each additional training phase uses a training dataset comprising reduced-size (e.g., truncated) versions of the files.