CNN Malware Classification with API Embedding Visualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional approaches for classifying program behavior lack accuracy and fail to provide visualization or explanation of their predictions, making it difficult to distinguish between malicious and benign programs or classify malware into specific families.
Innovation Solution
A device and method utilizing a CNN architecture that transforms sequences of API calls and their arguments into embedding vectors, processed through convolution and max-pooling layers, and then classified using a dense layer, while also incorporating a visualization unit to explain and visualize the classification decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional classification approaches use API call names and arguments, then classification accuracy improves, but the ability to explain and visualize predictions is lost
Solution Approach 1:
The patent segments the classification process into distinct components: a CNN model for accurate prediction and a visualization unit for explanation. The visualization unit processes the input sequence and model parameters separately to generate explanatory visual representations, allowing both high accuracy and interpretability to coexist by dividing the system's functionality into specialized segments
Solution Approach 2:
The visualization unit acts as an intermediary between the CNN model and the user. It takes the internal representations and decision-making processes of the CNN (which provide accuracy) and transforms them into visual formats that humans can understand (which provide explanation). This intermediary component bridges the gap between accurate black-box prediction and interpretable explanation
2Measurement precision
If CNN architecture processes complete sequences of API calls, then classification accuracy improves, but processing time increases
Solution Approach 1:
The patent applies preliminary action by using max-pooling layers to pre-process and condense the sequential API call data before final classification. The max-pooling operation identifies and retains only the most significant features (maximum values) from sequences of convoluted data, performing useful reduction and selection in advance to reduce the computational burden on subsequent classification stages
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to the field of classifying program behavior. The invention particularly presents a device for classifying program behavior, which achieves a higher classification accuracy. Further, the device of the invention can visualize the classification decisions it makes. The device is especially suited to be used in the detection and classification of malware. The device comprises a Convolutional Neural Network (CNN). In operation, the device is configured to provide, as an input to the CNN, a sequence of action-patterns pairs. Thereby, an action is indicative of a name or group of names of an Application Programing Interface (API) function call. A pattern is further indicative of an argument or set of arguments of an API function call. The device is then configured to transform, in an embedding layer of the CNN, each action-pattern pair into an embedding vector and concatenate the embedding vectors to obtain a single vector. Further, to process, in a convolution layer of the CNN, the single vector by a plurality of convolution filters to generate a series of output values per filter. Further, to determine, in a max-pooling layer of the CNN, a maximum output value in each series of output values. Finally, to transform, in a dense layer of the CNN, the maximum output values into a plurality of classification results.