Convolutional Neural Network for Malware Detection in Disassembled Binary Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inefficient in detecting malicious computer programs due to the complexity of analyzing binary files, which are not easily comprehensible in their binary format, making it difficult for human operators to identify malicious executables.
Innovation Solution
A convolutional neural network is trained to detect malware by processing disassembled binary files, generating fixed-length representations of instructions, and applying kernels to identify specific sequences, enabling efficient classification of files as malicious or benign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If human operators inspect disassembled object code to detect malware, then detection reliability may be maintained, but productivity and efficiency deteriorate significantly
Solution Approach 1:
The patent replaces manual human inspection of disassembled code with an automated convolutional neural network system. The CNN processes disassembled binary files through multiple convolutional layers that detect instruction sequences and patterns, substituting the mechanical/manual analysis process with an automated neural network-based system that achieves both high productivity and maintained detection reliability
Solution Approach 2:
The patent introduces disassembled instruction sequences as an intermediary representation between raw binary code and malware detection. By first disassembling binary files into human-readable instruction sequences, the system creates an intermediate form that can be efficiently processed by the CNN, bridging the gap between binary analysis and pattern recognition
2Ease of operation
If binary files are analyzed in their original binary format, then analysis speed may be maintained, but ease of operation and comprehension deteriorate
Solution Approach 1:
The patent segments binary files into discrete instruction sequences through disassembly. Each instruction is broken down into identifiable components (mnemonics, operands, flags) that can be individually processed by the CNN. This segmentation transforms the monolithic binary format into structured, comprehensible instruction units while maintaining analysis efficiency through automated processing
3Productivity
If manual inspection of binary files is performed, then detection precision may be maintained, but productivity deteriorates
Solution Approach 1:
The patent replaces manual inspection with a convolutional neural network that automatically analyzes disassembled binary files. The CNN processes multiple instruction sequences through convolutional layers, pooling operations, and classification layers to achieve both high throughput and maintained detection accuracy, eliminating the trade-off between speed and reliability present in manual methods
Data Source
AI summary
In one respect, there is provided a system for training a neural network adapted for classifying one or more scripts. The system may include at least one processor and at least one memory. The memory may include program code which when executed by the at least one memory provides operations including: receiving a disassembled binary file that includes a plurality of instructions; processing the disassembled binary file with a convolutional neural network configured to detect a presence of one or more sequences of instructions amongst the plurality of instructions and determine a classification for the disassembled binary file based at least in part on the presence of the one or more sequences of instructions; and providing, as an output, the classification of the disassembled binary file. Related computer-implemented methods are also disclosed.