Executable File Feature Extraction for Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional machine learning engines face poor recognition rates due to coarse granularity in static features extracted from executable files, primarily from import tables, export tables, and section information, limiting the effectiveness of malware detection models.

Innovation Solution

The method involves dividing executable files into multiple parts based on their data directory, extracting information entropy features from these parts, and performing data transformations like DCT or DWT to obtain static features with finer granularity, which are then used to train the machine learning engine.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If information entropy is extracted from main features (import table, export table, section information) of executable files, then the feature extraction process is simple, but the extracted features have coarse granularity resulting in poor recognition rate

Engineering Contradiction:
Improverecognition rateVSAvoidfeature extraction complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The executable file is divided into multiple sections based on the data directory structure (including import table section, export table section, section table section, and overlay data section). Information entropy is extracted from each section separately, transforming a single coarse-grained feature extraction into multiple fine-grained extractions, thereby improving recognition rate while managing complexity through structured segmentation

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

Different sections of the executable file are treated with different extraction strategies appropriate to their local characteristics. For example, the import table section and export table section use specific entropy calculation methods tailored to their structure, while overlay data sections use different approaches, optimizing the quality of features extracted from each local region

Inventive Principle:
Principle #3Local quality

2Measurement precision

If information entropy is extracted from all parts of executable files based on data directory, then the feature granularity is fine and recognition rate improves, but the feature extraction process becomes complex

Engineering Contradiction:
Improvefeature granularityVSAvoidextraction process complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The extraction process is segmented into distinct phases: first dividing the executable file according to the data directory into multiple sections, then extracting information entropy from each section separately. This segmentation transforms a complex monolithic extraction process into manageable modular steps, achieving fine granularity without overwhelming complexity

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The executable file is pre-divided into sections based on the data directory structure before information entropy extraction begins. This preliminary organization of data into logical sections simplifies the subsequent extraction process by providing a structured framework, reducing the complexity that would otherwise arise from processing the entire file as a single unit

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3812975B1Method and system for training machine learning engine and related device
Publication Date: 2023.09.20 SANGFOR TECH INC
  • EP3812975B1 patent drawingFigure 1~2
  • EP3812975B1 patent drawingFigure 3
  • EP3812975B1 patent drawingFigure 4~5

AI summary

Disclosed are a method and system for training a machine learning engine, a computer readable storage medium and a device for training a machine learning engine, the method comprising: obtaining an executable file, and dividing, according to a data directory of the executable file, the executable file into a plurality of parts to be extracted (S101); extracting information entropy features of all the parts to be extracted, and performing data transformation on all of the information entropy features to obtain static features (S102); and training a machine learning engine by using the static features (S103). The static features of the executable file can be extracted stably so that a detection model generated by the machine learning engine has a strong robust recognition rate.