CNN-Based Malware Detection via Binary Instruction Padding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are limited by their ability to identify features that can only be linearly separated and require significant time and effort, such as embedding check codes in processing programs, making them inefficient for detailed analysis.
Innovation Solution
A discrimination apparatus using a convolutional neural network (CNN) that extracts and processes instructions from binary data by padding them to a fixed length, performing bit encoding, and generating feature vectors for accurate classification, enabling detailed identification of programs and detection of malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a check code is embedded in a processing program to detect malware, then malware detection capability is improved, but the time and effort required for analysis increases
Solution Approach 1:
The patent applies preliminary action by pre-embedding check codes into processing programs before analysis. This allows the malware detection system to automatically verify program integrity and detect modifications without requiring manual inspection during the analysis phase, thereby improving detection capability while reducing analysis time and effort
Solution Approach 2:
The patent implements self-service through automatic check code verification mechanisms that enable the system to detect malware independently without requiring extensive manual analysis. The embedded check codes allow the program to self-verify its integrity, reducing the need for human analysts to manually examine each program for malware indicators
2Ease of manufacture
If traditional linear separation methods are used to identify malware features, then implementation simplicity is maintained, but identification accuracy is limited
Solution Approach 1:
The patent applies parameter changes by transitioning from traditional linear separation methods to deep learning-based feature extraction. This involves changing the analytical parameters from simple statistical features to complex, multi-dimensional feature representations that capture subtle malware characteristics, thereby improving identification accuracy while maintaining implementation feasibility through automated processing
Data Source
AI summary
According to the present embodiment, a discrimination apparatus includes a processor. The processor extracts a plurality of instructions from binary data. The processor generates a plurality of input data strings by padding with a fixed character on data strings of the instructions so that the data strings of the instructions each have a fixed length. The processor generates a feature vector of a program including the instructions or a classification result related to the program by using the input data strings and a trained convolutional neural network including a convolution layer that performs processing in units of the instructions.