Entity Resolution for Malicious File Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious digital documents, such as those in PDF and Microsoft Word formats, rely on large datasets and inefficient feature sets, leading to inefficiencies and high training requirements, and struggle to classify documents with high accuracy using small data.
Innovation Solution
A computer-implemented method that monitors system call invocations made by an application as it processes a digital file, automatically features these invocations, and compares them to a whitelist of benign features using entity resolution to identify non-correlated features, determining maliciousness based on the number of non-correlated features exceeding a threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus systems use large curated databases of byte-signatures or machine learning models trained on extensive corpora, then detection coverage improves, but system complexity and training requirements increase significantly
Solution Approach 1:
The patent extracts only the essential system call features from the complex document processing behavior, isolating the critical interactions between the document viewer and operating system. This extraction approach reduces the feature set from extensive corpora to a manageable collection of system call invocations, achieving reliable detection without requiring large training datasets
Solution Approach 2:
The patent segments the document analysis process into distinct system call categories (file operations, registry access, process creation, etc.), allowing each segment to be analyzed independently. This segmentation enables efficient feature comparison against known benign patterns without processing the entire document corpus, reducing overall system complexity while maintaining detection accuracy
2Ease of manufacture
If static feature analysis or byte-signature matching is used for document classification, then implementation simplicity is maintained, but detection accuracy and adaptability to new threats decrease
Solution Approach 1:
The patent introduces system call invocations as an intermediary layer between the document content and the detection algorithm. Instead of directly analyzing document bytes or static features, the system monitors the dynamic system calls made during document processing. This intermediary approach maintains implementation simplicity while significantly improving detection accuracy and adaptability to novel threats
Solution Approach 2:
The patent transitions from static document analysis to dynamic behavior monitoring by observing system call invocations during document processing. This dynamic approach allows the system to detect malicious behavior patterns regardless of how the malware is obfuscated in the static document, improving reliability while keeping the implementation straightforward through standard system call interception
3Reliability
If extensive training data and large corpora are used to train detection models, then detection coverage improves, but processing time and computational resources increase
Solution Approach 1:
The patent enables the detection system to self-adapt by automatically learning from observed system call patterns during normal operation. Instead of requiring extensive offline training on large corpora, the system builds its detection capabilities through self-service learning from actual document processing behavior, significantly reducing training time and computational resource requirements while maintaining comprehensive detection coverage
Data Source
AI summary
A method includes monitoring system call invocations made to an operating system of a computer system by an application as the application renders a digital file. The method automatically featurizes the system call invocations into a set of features corresponding to the digital file, and compares each feature set against benign features of a set of known benign features. The comparing includes, for each feature of the set of features, applying entity resolution between the feature and benign feature(s) of the set of known benign features to find a correlation between the feature and a benign feature representing a common semantic interaction between the application and the operating system. The method identifies a number of features that do not correlate to the benign features, and determines maliciousness of the digital file based on the identified number of features that do not correlate to the benign features.