Deep Generative Malware Detection via Anomaly Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems face challenges in accurately classifying malicious artifacts due to adversarial techniques that modify malware to evade classification, and they lack expressivity in capturing complex data structures, leading to limited precision in identifying anomalous files.
Innovation Solution
The implementation of deep generative models, specifically likelihood-based models like variational autoencoders and normalizing flows, for anomaly detection, which provide a rich class of density estimators to score anomaly levels in new samples, enhancing the precision of malware classification by combining scores from multiple models and weighting them based on anomaly levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus solutions are used, then basic malware detection is provided, but adversarial techniques can easily spoof or bypass the detection
Solution Approach 1:
The patent applies dynamics by making the detection system adaptive through continuous learning. The system dynamically adjusts its detection thresholds and retrain models based on newly identified malware patterns, allowing it to evolve against adversarial techniques rather than relying on static detection rules that can be easily spoofed
Solution Approach 2:
The patent changes parameters by transforming malware detection from binary classification to continuous scoring based on likelihood ratios. By calculating anomaly scores and adjusting detection thresholds dynamically based on confidence levels, the system can adapt its sensitivity to counter adversarial attempts while maintaining high detection accuracy
2Measurement precision
If simple detection models are used, then computational efficiency is maintained, but precision in identifying anomalous files is limited
Solution Approach 1:
The patent segments the detection process into distinct modular components: feature extraction, likelihood calculation, anomaly scoring, and threshold-based classification. This segmentation allows each component to be optimized independently, maintaining computational efficiency while achieving high precision through the coordinated workflow of specialized modules
Solution Approach 2:
The patent introduces intermediary elements including confidence scores and likelihood ratios that bridge simple input features and final detection decisions. These intermediaries provide nuanced measurement of anomaly levels, enabling high precision detection while keeping the overall system architecture manageable through structured information flow
3Adaptability or versatility
If multimodal detection systems are implemented, then comprehensive malware analysis is achieved, but false positives and false negatives increase without proper score fusion
Solution Approach 1:
The patent implements feedback mechanisms where detection results and confidence scores from multiple modalities are aggregated and used to adjust overall detection thresholds. The system learns from the combined outcomes of different detection modes, refining its classification accuracy by weighing evidence from each modality according to its reliability and contextual relevance
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Features are extracted from an artifact so that a vector can be populated. The vector is then inputted into an anomaly detection model comprising a deep generative model to generate a first score. The first score can characterize the artifact as being malicious or benign to access, execute, or continue to execute. In addition, the vector is inputted into a machine learning-based classification model to generate a second score. The second score can also characterize the artifact as being malicious or benign to access, execute, or continue to execute. The second score is then modified based on the first score to result in a final score. The final score can then be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.