Cross-Language Malicious Program Detection Via API Feature Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques struggle to accurately detect malicious programs in programming languages with a small amount of label information due to insufficient supervised learning.
Innovation Solution
A program identification method that converts feature vectors from a second programming language into a first language using a correspondence between APIs, allowing a machine learning model trained on the first language to identify malicious programs in the second language.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a machine learning model is trained on programs in a first programming language, then the model can accurately detect malicious programs in that language, but the model cannot directly detect malicious programs in a different second programming language
Solution Approach 1:
The patent transforms the feature vectors by changing their format parameters to match between different programming languages. Specifically, it converts feature vectors from a second programming language into a first programming language format using API correspondence relationships, enabling the machine learning model trained on the first language to process and detect malicious programs in the second language while maintaining detection accuracy.
Solution Approach 2:
The patent introduces an intermediary conversion process that acts as a bridge between different programming languages. The feature vector format conversion system serves as this intermediary, translating features from one language's representation into another language's representation, allowing the machine learning model to indirectly analyze programs from languages it wasn't directly trained on.
2Adaptability or versatility
If feature vectors are converted between different programming language formats using API correspondence, then the machine learning model can detect malicious programs across different languages, but the conversion process increases system complexity
Solution Approach 1:
The patent creates a universal feature vector format conversion system that can handle multiple programming languages through a common interface. By establishing API correspondence relationships between different languages and implementing a unified conversion mechanism, the system achieves multi-language detection capability without requiring separate conversion systems for each language pair, thereby managing complexity while maintaining versatility.
Data Source
AI summary
A program identification method includes: (i) obtaining a machine learning model generated through training with use of labeled training data including first feature vectors and identification information items each indicating whether a first program is malicious, and each of the first feature vectors is expressed in a first format indicating whether each of first functions of a program in a first language is to be used by the first program; (ii) generating a second feature vector expressed in a second format indicating whether each of second functions of a program in a second language is to be used by a second program; (iii) converting the format of the second feature vector into the first format; and (iv) outputting an identification result indicating whether the second program is malicious, where the identification result is obtained by inputting, to the machine learning model, the second feature vector whose format has been converted.