Executable Code Detection via N-gram Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems and methods for detecting executable code and position independent code are inefficient and inaccurate, failing to effectively prevent and detect malicious threats to computer systems.
Innovation Solution
A computer-implemented method and system that programmatically identifies executable code within a file by accessing a sequence of bytes, extracting n-grams, generating counters for frequency analysis, and using a predictive machine learning model to determine the probability of executable code without executing the sequence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing systems execute code to detect executable code, then detection accuracy is improved, but processing time and system resource consumption increase
Solution Approach 1:
The patent creates a copy of the code's structural and statistical properties through n-gram extraction, rather than executing the actual code. The n-grams capture the sequential patterns and characteristics of executable code, allowing the machine learning model to analyze these features and detect executable code with high accuracy without incurring the time cost of execution.
2Measurement precision
If existing systems execute code to detect executable code, then detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
Instead of executing the code which consumes CPU cycles, memory, and other system resources, the patent extracts n-gram features that copy the essential characteristics of the code. The machine learning model processes these lightweight features, achieving accurate detection with minimal system resource consumption.
3Measurement precision
If manual feature extraction is used, then detection accuracy is improved, but automation level decreases
Solution Approach 1:
The system performs self-service by automatically extracting n-gram features and feeding them into the machine learning model without requiring manual intervention. The entire process from n-gram extraction to feature generation and detection is automated, maintaining high detection accuracy while achieving full automation.
4Adaptability or versatility
If traditional detection methods are used, then compatibility with existing systems is maintained, but detection accuracy decreases
Solution Approach 1:
The patent introduces n-gram features as an intermediary representation between the raw code and the machine learning model. This intermediary layer captures the essential patterns of executable code in a format that is compatible with standard machine learning pipelines, enabling accurate detection while maintaining integration with existing systems.
Data Source
AI summary
Disclosed herein are systems and methods for enabling the automatic detection of executable code from a stream of bytes. In some embodiments, the stream of bytes can be sourced from the hidden areas of files that traditional malware detection solutions ignore. In some embodiments, a machine learning model is trained to detect whether a particular stream of bytes is executable code. Other embodiments described herein disclose systems and methods for automatic feature extraction using a neural network. Given a new file, the systems and methods may preprocess the code to be inputted into a trained neural network. The neural network may be used as a “feature generator” for a malware detection model. Other embodiments herein are directed to systems and methods for identifying, flagging, and/or detecting threat actors which attempt to obtain access to library functions independently.