Disassembly Feature Extraction for Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security software struggles to accurately classify malicious software due to features like file size and entropy being easily manipulated by malware authors, leading to misclassification.
Innovation Solution
A system and method utilizing disassembly features with a machine-learning algorithm to classify software intent, which includes extracting and processing features such as entry points, instruction ratios, anti-virtual machine instructions, and API call proximity, making it harder for malicious software to be misclassified.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If conventional features (file size, entropy, portable executable attributes) are used for classification, then the classification process is simple, but the accuracy is reduced due to feature manipulation by malware authors
Solution Approach 1:
The patent transforms the classification approach by changing from analyzing static file attributes (size, entropy) to analyzing dynamic execution behavior parameters (API call sequences, control flow patterns, register states). This parameter transformation makes the features resistant to manipulation while maintaining analysis feasibility through automated dynamic analysis frameworks
Solution Approach 2:
The patent replaces the mechanical/static analysis system (examining file properties) with a dynamic simulation system that executes the malware in a controlled virtual environment and observes its behavioral parameters. This substitution captures runtime characteristics that cannot be manipulated in static files
2Measurement precision
If more features are analyzed to improve accuracy, then the classification becomes more robust, but the processing time and complexity increase
Solution Approach 1:
The patent performs preliminary actions by pre-compiling comprehensive feature sets from dynamic analysis, pre-establishing behavioral baselines for known malware families, and pre-configuring the virtual execution environment. This preliminary preparation enables faster real-time classification without sacrificing feature completeness
Solution Approach 2:
The patent segments the analysis into distinct phases: static feature extraction, dynamic execution monitoring, behavioral pattern recognition, and classification. Each segment processes specific feature types independently, enabling parallel processing and reducing overall processing time while maintaining comprehensive analysis
3Adaptability or versatility
If the system is made customizable and extensible to adapt to new malware, then the system becomes more flexible, but the system complexity increases
Solution Approach 1:
The patent implements a universal classification framework that handles multiple malware types and analysis methods through a common architecture. The system provides universal interfaces for adding new features, plugins, and analysis techniques without requiring changes to the core classification engine, thereby managing complexity while maintaining versatility
Data Source
AI summary
A system and method operable to identify malicious software by extracting one or more features disassembled from software suspected to be malicious software and employing one or more of those features in a machine-learning algorithm to classify such software.