Conjoining Malware Detection Models via Tuned Activation Range
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The dynamic and evolving nature of malware threats, characterized by code obfuscation, polymorphism, and metamorphism, poses a challenging security threat landscape that existing security systems struggle to address effectively, often requiring new detection models that balance detection rate and false positive rate, which can be time-consuming to deploy.
Innovation Solution
Conjoining an incumbent machine learning model with a candidate model using a tuned activation range, where inputs within a specific output range from the incumbent model activate the candidate model, thereby managing the false positive rate and enhancing the malware detection rate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a candidate detection model with higher detection rate is deployed, then the malware detection rate is improved, but the false positive rate increases
Solution Approach 1:
The detection process is segmented into two stages: first the incumbent model performs initial detection, then the candidate model is selectively activated only for samples falling within a specific output range from the incumbent model. This segmentation allows the system to leverage the higher detection rate of the candidate model while limiting its application to reduce false positives.
Solution Approach 2:
The system dynamically adjusts which model processes which samples based on the incumbent model's output values. Samples with output values within a tuned activation range are routed to the candidate model, while others are handled by the incumbent model. This dynamic routing optimizes the balance between detection rate and false positive rate.
2Reliability
If a candidate detection model is deployed to improve detection rate, then detection performance is improved, but validation and deployment time increases
Solution Approach 1:
The incumbent model is deployed first and serves as a filter to identify samples that need further analysis. By performing preliminary detection with the incumbent model, the system avoids the time-consuming validation process for all samples, activating the candidate model only when necessary based on the incumbent model's output.
Solution Approach 2:
The incumbent model acts as an intermediary between the input samples and the candidate model. It processes all samples first and uses its output values to determine which samples should be passed to the candidate model, thereby reducing the overall validation time while maintaining high detection rates.
3Reliability
If the candidate model is activated for all inputs, then detection rate improves, but system complexity and computational overhead increases
Solution Approach 1:
The system segments the processing workload by dividing samples into two groups: those handled by the incumbent model and those activated for candidate model processing. This segmentation is based on the incumbent model's output values falling within a specific activation range, thereby reducing overall system complexity.
Solution Approach 2:
Instead of applying the candidate model to all inputs (excessive action), the system applies it only to a partial subset of samples where the incumbent model's output values fall within a tuned activation range. This partial application reduces computational overhead and system complexity while maintaining effective detection.
Data Source
AI summary
To leverage the higher detection rate of a supplemental model and manage the higher false positive rate of that model, an activation range is tuned for the candidate model to operate in conjunction with an incumbent model. The activation range is a range of output values for the incumbent model that activates the supplemental model. Inputs having benign output values from the incumbent model that are within the activation range are fed into the supplemental model. Thus, the lower threshold of the activation range corresponds to the malware detection threshold of the incumbent model and the upper threshold determines how many benign classified outputs from the incumbent model activate the supplemental model. This conjoining of models with a tuned activation range manages overall false positive rate of the conjoined detection models while the malware detection rate increases over the incumbent detection model alone.