Malicious Container Detection via Precomputed Convolutions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in efficiently detecting malicious container files, particularly those of unknown types, and struggle with resource-intensive dynamic analysis, leading to lower detection rates and higher false alarms when computing resources are limited.
Innovation Solution
A system and method for training a machine learning model to detect malicious container files by selecting parameters from both malicious and safe container files, generating convolutions based on these parameters, and modifying the model to compute a degree of harmfulness, which allows for rapid and reliable analysis of container files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is used to detect malicious programs, then detection effectiveness is improved, but resource consumption and analysis time increase
Solution Approach 1:
The patent applies preliminary action by pre-computing convolutions from container files during an offline training phase. These pre-computed convolutions are stored and later used during online detection without requiring re-execution of dynamic analysis. This resolves the contradiction by performing the resource-intensive dynamic analysis beforehand, so that subsequent detections can rely on preprocessed data, reducing both resource consumption and analysis time while maintaining high detection effectiveness.
2Use of energy by moving object
If static analysis is used for antivirus scanning, then resource consumption is reduced, but detection effectiveness decreases
Solution Approach 1:
The patent introduces convolutions as an intermediary representation that bridges static and dynamic analysis. During offline training, dynamic analysis is performed to extract meaningful features and compute convolutions. During online detection, these pre-computed convolutions serve as an intermediary that enables fast static-like analysis while preserving the detection power of dynamic analysis. This resolves the contradiction by using convolutions as a mediator that captures dynamic behavior patterns without requiring real-time dynamic execution.
3Productivity
If machine learning model training is performed offline, then online detection speed is improved, but training resource requirements increase
Solution Approach 1:
The patent segments the overall detection process into two distinct phases: offline training and online detection. The offline phase performs resource-intensive tasks including dynamic analysis, convolution computation, and model training. The online phase uses the pre-trained model and pre-computed convolutions for fast detection. This segmentation resolves the contradiction by concentrating resource consumption in the offline phase, enabling rapid online detection while acknowledging the trade-off of upfront training resource requirements.
Data Source
AI summary
Disclosed are systems and methods for training and retraining a model for detection of malicious activity from container files, which contain at least two or more objects constituting logically separate data regions. Parameters of each object chosen from at least one safe container and one malicious container are determined which uniquely characterize the functional relation of the mentioned object to at least one selected object. Convolutions are formed separately for each container on the basis of the determined parameters of the objects, which are used to train a machine learning model for detecting malicious container files.