Embedding-Based Malware Detection With Representative Token Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud detection systems have high false negative rates in detecting malicious JavaScript files, and analyzing large amounts of content is resource intensive, necessitating more efficient and effective methods.
Innovation Solution
An embedding-based machine learning model is employed to analyze content, creating representative embeddings that are classified by a machine learning model to detect malicious JavaScript code, reducing data storage and processing needs while maintaining accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current cloud detection systems analyze large amounts of content to detect malicious JavaScript files, then detection coverage is improved, but resource consumption increases and processing efficiency decreases
Solution Approach 1:
The patent extracts only the essential features from the full JavaScript content by generating embeddings that capture semantic meaning. Instead of analyzing the complete content, the system extracts representative embeddings that preserve malicious patterns while discarding redundant information, thus reducing processing resources while maintaining detection accuracy
Solution Approach 2:
The patent transforms the content representation from raw JavaScript code to embedded vector representations. This parameter transformation converts complex code structures into numerical vectors that are more efficient for machine learning processing, enabling faster analysis with reduced computational overhead while maintaining detection capability
2Reliability
If current cloud detection systems analyze all content to maintain high detection accuracy, then false negative rate decreases, but data storage requirements and processing time increase
Solution Approach 1:
The system extracts only the essential semantic information from JavaScript content through embedding generation. By taking out only the critical features needed for malicious content detection and storing only these compressed representations rather than the full content, the system reduces storage requirements while maintaining detection accuracy
Solution Approach 2:
The patent creates compressed copies of the original content in the form of embeddings. These embedding copies contain the essential malicious patterns and semantic meaning but occupy significantly less storage space, enabling the system to retain analysis results without storing the complete original content
Data Source
AI summary
Content is received for security analysis. At least a portion of the received content is sampled to determine a set of representative tokens. At least the set of representative tokens is embedded to determine a representative embedding. The representative embedding is applied to a machine learning model to classify the received content for the security analysis.