Malware Detection in Documents Using Segmented Supervised Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based approaches to detecting malware in Office documents are easily evaded, making it challenging to effectively identify malicious code, especially as Office documents have become a common vector for malware infection.
Innovation Solution
A method and system that extract text and metadata content from documents, derive features from these contents, and apply supervised models to generate predictions about the presence of malicious code, combining these predictions to accurately identify malicious documents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature-based approaches are used to detect malware in Office documents, then the detection method is simple to implement, but the detection accuracy deteriorates because malware can easily evade signature-based detection
Solution Approach 1:
The patent segments the document analysis into multiple independent content types (text, metadata, executable code, formulas, charts) and applies separate supervised models to each type. This segmentation allows the system to specialize in detecting different malware indicators in each content type while maintaining overall system manageability and implementation feasibility.
Solution Approach 2:
The patent combines predictions from multiple supervised models (text model, metadata model, executable code model, formula model, chart model) into a composite detection result. This composite approach integrates diverse detection capabilities to achieve high accuracy while each individual model remains relatively simple to implement and maintain.
2Measurement precision
If multiple supervised models are applied to different content types, then the detection accuracy improves, but the system complexity increases
Solution Approach 1:
The system divides the complex detection task into manageable segments by creating separate supervised models for different content types (text, metadata, executable code, formulas, charts). Each model focuses on specific features relevant to its content type, making individual models simpler while the ensemble achieves high overall accuracy.
Solution Approach 2:
The patent implements a universal document analysis framework that handles multiple content types through a common architecture. The system extracts features from various content types, applies appropriate supervised models to each, and combines results through a unified prediction mechanism, achieving multi-functionality without proportionally increasing complexity.
3Reliability
If comprehensive feature extraction from multiple content types is performed, then the ability to detect evasive malware improves, but the processing time and computational resources increase
Solution Approach 1:
The system segments feature extraction and model application by content type, allowing parallel processing of different document elements. This segmentation enables comprehensive analysis of text, metadata, executable code, formulas, and charts simultaneously, improving detection capability while managing processing time through efficient resource allocation.
Solution Approach 2:
The patent applies supervised models selectively based on the presence and relevance of different content types in the document. Not all content types are present in every document, and not all models need to be applied to every document, allowing the system to perform partial analysis when appropriate while maintaining comprehensive detection capability when needed.
Data Source
AI summary
A method may include extracting, from a document, first content of a first content type and second content of a second content type, deriving first features from the first content and second features from the second content, and generating a first prediction by applying a first supervised model to the first features and a second prediction by applying a second supervised model to the second features. The first supervised model may correspond to the first content type, and the second supervised model may correspond to the second content type. The method may further include combining the first prediction and the second prediction to predict that the document comprises malicious code.