Ensemble Malware Detection Using Dynamic Report Text Features

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing malware detection techniques, such as signature matching and heuristics, are ineffective against evolving malware due to the increasing variety and number of software types, leading to high false positive and false negative rates.

Innovation Solution

An ensemble malware detector using natural language processing on dynamic malware analysis reports, combining a neural network with an embedding layer and a boosting model, aggregates token-based and n-gram features to improve detection accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If signature matching and heuristic techniques are used for malware detection, then detection speed is maintained, but detection accuracy deteriorates due to evolving malware and increasing software variety

Engineering Contradiction:
Improvemalware detection accuracyVSAvoidefficacy against evolving malware
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent transforms malware detection from traditional parameter-based methods (signatures, heuristics) to a natural language processing approach where dynamic analysis reports are converted into text-based features. This parameter transformation enables the system to adapt to evolving malware by analyzing behavioral patterns rather than static characteristics, resolving the contradiction between detection accuracy and adaptability to new threats

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The patent replaces mechanical detection methods (signature matching, heuristic analysis) with an information-processing system based on natural language processing and machine learning. By substituting the mechanical approach with an intelligent system that processes dynamic analysis reports as text, the system achieves both high detection accuracy and adaptability to evolving malware variants

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If ensemble methods combining multiple models are used, then detection accuracy improves, but system complexity increases

Engineering Contradiction:
Improvemalware classification accuracyVSAvoiddetector architecture complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the malware detection task into distinct processing pipelines: dynamic analysis report generation, text-based feature extraction, and ensemble classification. Each pipeline handles a specific aspect of the detection process, allowing the complex ensemble system to be managed through modular components. This segmentation reduces the perceived complexity while maintaining the accuracy benefits of ensemble methods

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent creates a universal feature extraction framework that processes dynamic analysis reports through multiple pipelines to generate features suitable for different classification models. This multi-functional approach allows the same input (dynamic analysis report) to be processed by various models (neural networks, boosting algorithms, traditional classifiers) without requiring separate feature extraction for each, thereby managing complexity while achieving high accuracy through ensemble methods

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP4502868B1Execution behavior analysis text-based ensemble malware detector
Publication Date: 2026.03.25 PALO ALTO NETWORKS INC
  • EP4502868B1 patent drawingFigure 1
  • EP4502868B1 patent drawingFigure 2
  • EP4502868B1 patent drawingFigure 3

AI summary

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a neural network having an embedding layer. The malware detector then extracts a dense layer from the neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the boosting model to generate a malware detection output.