Embedded Malware Detection via Spatial Voting and Machine Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods, such as signature-based and heuristics-based approaches, are time-consuming, computation-intensive, and prone to false positives, requiring frequent updates to known malware databases, which do not effectively address the increasing vulnerabilities in electronic component supply chains.
Innovation Solution
The use of spatial voting and machine learning to detect embedded malware by encoding binary images, extracting statistical features, and inputting gridded data to an AI/ML model trained to differentiate between benign and malicious code, providing a data-agnostic solution that reduces processing complexity and enhances detection confidence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detectors are used to identify malware by comparing file codes against a database of known virus codes, then detection accuracy for known malware is improved, but the system becomes time-consuming and computation-intensive requiring frequent database updates
Solution Approach 1:
The system performs preliminary encoding of the binary image into a grid structure and extracts statistical features in advance, transforming the detection problem into a pattern recognition task that can be solved more efficiently by machine learning models without requiring exhaustive comparison against large malware databases
Solution Approach 2:
The patent replaces the mechanical signature-matching process with an AI-based machine learning system that uses spatial voting and neural networks to detect malware patterns, substituting computation-intensive database comparisons with a more efficient intelligent recognition system
2Reliability
If heuristics-based detectors accumulate multiple malware samples and compare each against a database of potential known malware using pattern matching, then the ability to identify suspicious files is improved, but the computational complexity and processing time increase significantly
Solution Approach 1:
The system extracts only the essential statistical features from the binary image after encoding, removing unnecessary data while retaining the critical information needed for malware detection, thereby reducing computational complexity without sacrificing detection reliability
Solution Approach 2:
The patent transforms the binary image into a grid representation and extracts statistical parameters that capture the essential characteristics of the file, changing the parameter space from raw binary data to meaningful statistical features that are more efficient for machine learning analysis
3Ease of operation
If conventional malware detectors rely on prior knowledge of file types and use rules to determine whether code is malicious, then the detection process becomes simpler, but the system produces a large number of false positives especially when files are modified by users or systems
Solution Approach 1:
The system adds a spatial dimension by encoding the binary image into a grid structure and using spatial voting, allowing the machine learning model to analyze patterns in multiple dimensions rather than relying on single-rule heuristics, thereby improving precision while maintaining operational simplicity
Solution Approach 2:
The patent introduces an intermediary machine learning model that acts as a mediator between the encoded binary image and the final detection decision, using trained spatial patterns to reduce false positives while keeping the detection process simple and automated
Data Source
AI summary
A system and method for detecting embedded malware from a device including a receiver for receiving embedded binary image; a memory for encoding and storing the received embedded binary image; and one or more processors coupled to the receiver. The method includes extracting statistical features from the encoded embedded binary image; producing gridded data from the statistical features, using SV; inputting the gridded data to a machine learning (ML) trained to detect embedded malware from the gridded data; and determining whether the embedded binary image is benign or malware.