Executable File Analysis Using PE Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for static analysis of executable files, such as graph analysis and neural networks, are inefficient and prone to errors due to disassembly challenges and code obfuscation, making it difficult to accurately identify malicious files before they are launched.
Innovation Solution
A computer-implemented method using predictive models that analyzes executable files based on features extracted from PE-files and indicators of compromise, without disassembling the files, to determine if they are malicious or benign, by training an ensemble of classifiers to generate a weighted prediction of their maliciousness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If graph analysis and neural networks are used for static analysis, then detection capability is improved, but analysis speed decreases and complexity increases
Solution Approach 1:
The patent replaces complex mechanical analysis systems (graph analysis, neural networks) with a simpler rule-based detection system. The method extracts features from executable files and compares them against predefined detection rules, eliminating the need for computationally intensive graph construction and neural network inference while maintaining effective detection capability.
Solution Approach 2:
The patent changes the approach from analyzing complex structural parameters (control flow graphs, neural network representations) to extracting simpler feature parameters (PE file characteristics, code patterns). This parameter transformation enables faster analysis by working with more compact and easier to process data representations that capture essential malicious indicators.
2Measurement precision
If disassembly is performed to analyze executable files, then analysis depth is improved, but error rate increases due to disassembly errors and code obfuscation
Solution Approach 1:
The patent extracts useful information directly from the executable file's PE structure and code patterns without performing full disassembly. By taking out key features such as section headers, import tables, and characteristic code patterns, the method achieves sufficient analysis depth while avoiding the errors and complexities of complete disassembly processes.
Solution Approach 2:
Instead of disassembling code to analyze it (traditional approach), the patent inverts the approach by directly analyzing the PE file structure and extracting features from the assembled binary format. This inversion avoids disassembly errors and handles code obfuscation more effectively by working with the file's structural characteristics rather than its executed instructions.
3Adaptability or versatility
If code obfuscation is used by malicious files, then evasion capability is improved, but detection difficulty increases
Solution Approach 1:
The patent segments the analysis into distinct feature extraction categories (PE file structure features, code pattern features, import/export table features). By analyzing multiple independent segments of the file structure, the system can detect obfuscated code through pattern recognition in different segments, making evasion more difficult as obfuscation would need to conceal patterns across multiple analysis dimensions simultaneously.
Data Source
AI summary
A method and a system for analysis of executable files are provided. The method comprises: obtaining a plurality of training executable files including at least one malicious executable file and at least one benign executable file; analyzing the plurality of training executable files to extract therefrom data including a plurality of features; transforming the data organizing the plurality of features in sets of features, a given one of which includes features of a respective predetermined type; identifying, in the given set of features, informative features indicative of a given training executable file being one of malicious and benign; combining, over the plurality of training executable files, for the respective predetermined data type, the informative features to generate at least one feature vector; and training, based on the at least one feature vector, at least one of classifier to determine if an in-use executable file is one of malicious and benign.