Executable File Feature Extraction for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional machine learning engines face poor recognition rates due to coarse granularity in static features extracted from executable files, primarily from import tables, export tables, and section information, limiting the effectiveness of malware detection models.
Innovation Solution
The method involves dividing executable files into multiple parts based on their data directory, extracting information entropy features from these parts, and performing data transformations like DCT or DWT to obtain static features with finer granularity, which are then used to train the machine learning engine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If information entropy is extracted from main features (import table, export table, section information) of executable files, then the feature extraction process is simple, but the extracted features have coarse granularity resulting in poor recognition rate
Solution Approach 1:
The executable file is divided into multiple sections based on the data directory structure (including import table section, export table section, section table section, and overlay data section). Information entropy is extracted from each section separately, transforming a single coarse-grained feature extraction into multiple fine-grained extractions, thereby improving recognition rate while managing complexity through structured segmentation
Solution Approach 2:
Different sections of the executable file are treated with different extraction strategies appropriate to their local characteristics. For example, the import table section and export table section use specific entropy calculation methods tailored to their structure, while overlay data sections use different approaches, optimizing the quality of features extracted from each local region
2Measurement precision
If information entropy is extracted from all parts of executable files based on data directory, then the feature granularity is fine and recognition rate improves, but the feature extraction process becomes complex
Solution Approach 1:
The extraction process is segmented into distinct phases: first dividing the executable file according to the data directory into multiple sections, then extracting information entropy from each section separately. This segmentation transforms a complex monolithic extraction process into manageable modular steps, achieving fine granularity without overwhelming complexity
Solution Approach 2:
The executable file is pre-divided into sections based on the data directory structure before information entropy extraction begins. This preliminary organization of data into logical sections simplifies the subsequent extraction process by providing a structured framework, reducing the complexity that would otherwise arise from processing the entire file as a single unit
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
Disclosed are a method and system for training a machine learning engine, a computer readable storage medium and a device for training a machine learning engine, the method comprising: obtaining an executable file, and dividing, according to a data directory of the executable file, the executable file into a plurality of parts to be extracted (S101); extracting information entropy features of all the parts to be extracted, and performing data transformation on all of the information entropy features to obtain static features (S102); and training a machine learning engine by using the static features (S103). The static features of the executable file can be extracted stably so that a detection model generated by the machine learning engine has a strong robust recognition rate.