Decision Forest Compilation for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Random forest mechanisms in computer security systems fail to incorporate interrelationships between attributes, leading to sub-optimum performance in malware detection.
Innovation Solution
The approach involves defining and incorporating interrelationships between features in decision trees within a decision forest, allowing for the construction of trees that consider related and unrelated features, and aggregating scores from multiple trees to determine malware presence using a Bayesian sum.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If random forest treats all attributes equally without incorporating interrelationships, then the system is simple to implement and fast to compile, but the malware detection accuracy is sub-optimum
Solution Approach 1:
The patent segments the decision forest into multiple distinct tree types (related-features trees, unrelated-features trees, and hybrid trees), each handling different aspect of feature relationships. This segmentation allows the system to incorporate complex feature interrelationships while maintaining manageable individual tree structures that can be compiled and executed efficiently
Solution Approach 2:
The patent introduces a new dimension to the decision tree structure by organizing trees according to their feature relationship characteristics (related, unrelated, hybrid). This dimensional organization allows the system to capture complex feature interrelationships without significantly increasing the computational complexity of individual trees, thereby improving detection accuracy while maintaining compilation speed
2Adaptability or versatility
If random forest uses a uniform structure for all decision trees, then the compilation process is fast and simple, but the system cannot leverage feature interrelationships for improved detection
Solution Approach 1:
The patent makes the decision forest dynamic by allowing different tree structures to coexist within the same forest. Each tree can be configured with different feature relationship characteristics (related, unrelated, or hybrid), enabling the system to adapt to different malware detection scenarios and leverage various feature interrelationships without requiring a completely new forest structure
Solution Approach 2:
The patent creates a universal decision forest framework that can accommodate multiple tree types serving different functions. The related-features trees capture local dependencies, unrelated-features trees provide baseline detection, and hybrid trees combine both approaches. This multi-functional structure allows the system to leverage various feature interrelationships while maintaining a unified compilation and execution process
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a processor; and a memory having encoded therein executable instructions to instruct the processor to: divide a file-under-analysis into a plurality of features; build a plurality of categories from the plurality of features, including a category of unrelated features; construct a first decision tree from a first category of the plurality of features, the first category including related features; construct a second decision tree from a second category of the plurality of features, the second decision tree including unrelated features; and determine, based at least partly on the first decision tree and the second decision tree, that the file under analysis has malware content.