Compressed Trace Modeling for Faster Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems face significant computational stress due to the need to analyze large volumes of repetitive and non-repetitive data traces, with most traces being similar and recurrent, leading to inefficient data processing and storage.
Innovation Solution
The implementation of filtering and compression techniques to identify repetitive traces versus non-repetitive traces, generating a model using graph nodes with weights to represent repetitive behaviors, and encoding these models for efficient transmission and analysis on endpoint devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware detection systems analyze all data traces in detail, then detection accuracy is improved, but computational stress and processing time increase significantly
Solution Approach 1:
The patent segments data traces into repetitive and non-repetitive categories using filtering techniques. Repetitive traces are identified and separated from non-repetitive traces, allowing the system to process only the essential non-repetitive traces in detail while handling repetitive traces through compression or summarization, thereby reducing processing time while maintaining detection accuracy.
Solution Approach 2:
The patent extracts and removes repetitive traces from the full dataset before detailed analysis. By identifying and extracting the subset of non-repetitive traces that contain unique information, the system eliminates redundant processing while preserving all critical detection capabilities, thus reducing computational stress without sacrificing detection accuracy.
2Reliability
If malware detection systems store and process all raw data traces, then complete analysis capability is maintained, but data storage requirements and processing overhead increase
Solution Approach 1:
The patent merges multiple repetitive traces into a single compressed representation or summary. By combining identical or similar repetitive traces into one aggregated form, the system maintains the ability to detect malicious patterns while significantly reducing the total data volume stored and processed, thus lowering storage requirements and processing overhead.
Solution Approach 2:
The patent discards redundant repetitive traces after extracting their essential information, and recovers the necessary analysis capability through compression techniques. The system retains only the essential characteristics of repetitive traces in compressed form, discarding the full redundant data, yet can recover complete analysis capability when needed through decompression or pattern matching on the compressed representation.
3Productivity
If filtering and compression techniques are applied to reduce data volume, then processing efficiency is improved, but system complexity increases
Solution Approach 1:
The patent applies filtering and compression techniques as preliminary actions before the main malware detection process. By pre-processing the data to remove repetitive traces and compress remaining data, the system improves subsequent processing efficiency while containing complexity in the pre-processing stage, allowing the core detection engine to operate on a reduced, optimized dataset.
Data Source
AI summary
Methods, apparatus, systems and articles of manufacture are disclosed to facilitate malware detection using compressed data. An example apparatus includes an input processor to obtain a model, the model identifying a first sequence associated with a first trace of data known to be repetitive, a sequence identifier to identify a second sequence associated with a second trace of data, a comparator to compare the first sequence with the second sequence, and an output processor to when the first sequence matches the second sequence, transmit an encoded representation of the second sequence to the central processing facility using a first channel of communication, and when the first sequence fails to match the second sequence, transmit the second sequence to the central processing facility using a second channel of communication, the second sequence to be analyzed by the central processing facility to identify whether the second sequence is indicative of malware.