Executable Sample Classification with NLP API Call Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively detect and classify malicious executable files that are disguised as legitimate software, compromising endpoint devices by initiating unauthorized API calls.
Innovation Solution
A system utilizing natural language processing (NLP) and machine learning models, such as neural networks, to analyze executable files, extract features, and classify them as clean or malicious by symbolizing API call sequences, with a framework that executes files in a sandbox environment to monitor and record API call sequences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then the system can detect known malware signatures, but it fails to detect malware disguised as legitimate software
Solution Approach 1:
The patent replaces traditional signature-based detection mechanisms with machine learning models that analyze behavioral patterns. The system uses supervised learning algorithms to classify executable files based on extracted features from API call sequences, replacing mechanical pattern matching with intelligent behavioral analysis that can detect disguised malware.
Solution Approach 2:
The system transforms the detection approach by changing from static signature matching to dynamic behavioral parameter analysis. It extracts multiple features including API call sequences, call graph metrics, and temporal patterns, then uses these transformed parameters as input to machine learning classifiers to improve detection of polymorphic and obfuscated malware.
2Measurement precision
If machine learning models are implemented, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the malware detection system into distinct modular components: an extraction module that gathers raw data from executable files, a feature engineering module that transforms raw data into meaningful features, and a classification module that applies machine learning models. This segmentation reduces system complexity by making each component independent and manageable while maintaining high detection accuracy.
Solution Approach 2:
The system introduces feature extraction as an intermediary layer between raw API call sequences and machine learning classification. This intermediary transforms complex, unstructured behavioral data into standardized numerical features, simplifying the input requirements for classifiers and reducing the overall system complexity while improving classification performance.
3Measurement precision
If API call sequences are analyzed in detail, then malware detection precision improves, but processing time increases
Solution Approach 1:
The patent extracts only the most discriminative features from complete API call sequences, such as specific call graph metrics, frequency patterns, and temporal characteristics, rather than analyzing every detail of the sequences. This selective extraction maintains high classification precision while significantly reducing processing time by focusing computational resources on the most informative features.
Data Source
AI summary
Sample classification using natural language processing (NLP) models is disclosed herein. An example apparatus comprises interface circuitry, machine readable instructions, and programmable circuitry to at least one of instantiate or execute the machine readable instructions to access a set of instructions, the set of instructions representing executable instructions, determine an Application Programming Interface (API) call sequence based on the set of instructions, transmit the API call sequence to a NLP model, the NLP model to generate a set of tokens, the set of tokens representing the API call sequence, the set of tokens readable in the NLP model, and classify the API call sequence as clean or malicious based on the tokens, and classify the set of instructions as clean or malicious based on the classification of the API call sequence and at least one other feature of the set of instructions.