Code-Level Statistical Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional static program analysis is limited in providing actionable insights due to its conservative nature and inability to relate analysis results to code-level artifacts, especially in complex software systems, which complicates malware detection and requires more efficient and usable code-level statistical analysis.
Innovation Solution
A method that identifies discriminating features in code through classification, determines their positions, and uses these features to enhance machine learning algorithms for malware detection by correlating traces with a catalog of features, providing code-level explanations for classification outcomes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional static program analysis is used, then analysis can be performed on complex software systems, but the analysis results are overly conservative and lack precision
Solution Approach 1:
The patent changes the analysis parameters by transitioning from traditional static analysis methods to statistical machine learning approaches. It uses feature extraction from code metrics, control flow graphs, and call graphs, then applies machine learning classifiers to achieve more precise malware detection while reducing false positives compared to conservative traditional analysis.
Solution Approach 2:
The patent substitutes the mechanical systematic approach of traditional static analysis with statistical machine learning methods. Instead of relying on fixed analysis rules and abstractions, it employs learned models that can adapt to diverse malware patterns, achieving higher precision without excessive conservatism.
2Measurement precision
If statistical machine learning techniques are used for code analysis, then precision is improved, but the ability to relate analysis results to code-level artifacts is lost
Solution Approach 1:
The patent segments the analysis into two parts: (1) statistical classification for precision, and (2) feature attribution for code-level explanation. It extracts specific code features (metrics, control flow patterns, call graph characteristics) that contribute to classification decisions, then maps these back to corresponding code locations and artifacts to maintain interpretability.
Solution Approach 2:
The patent introduces feature attribution mechanisms as intermediaries between the black-box statistical classifier and the code-level artifacts. By analyzing which features most influenced the classification decision and tracing them back to specific code metrics and structures, it bridges the gap between statistical precision and code-level interpretability.
3Ease of operation
If code-level analysis is performed to provide actionable insights, then usability is improved, but the complexity of analyzing complex software systems increases
Solution Approach 1:
The patent performs preliminary feature extraction and code metric calculation before the actual classification process. It pre-computes code characteristics, control flow features, and call graph metrics that will be used by the machine learning model, organizing complex code information into structured features that are easier to process and interpret.
Solution Approach 2:
The patent extracts specific discriminative features from the complex code base that are most relevant for malware detection. By identifying and focusing on key code metrics, control flow patterns, and structural characteristics that differentiate malicious from benign code, it simplifies the analysis while maintaining high precision and usability.
Data Source
AI summary
A method, system, and apparatus configured to identify discriminating features in a plurality of applications, determine via code analysis, when a first application is subjected to classification, positions of the first application's code that correspond to the discriminating features, and forward to a classification algorithm, such that according to its output the code fragments corresponding to the discriminating features are reported.