Executable Threat Detection Using Static Data Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat detection methods for executable files are time-consuming and risky, requiring decryption and execution to analyze behavior, which can harm the system and lead to high false positive rates.
Innovation Solution
A system that analyzes executable files without decryption or execution by using a machine learning classifier trained on static data points, including header, section, and certificate information, to classify files as malicious, benign, or potentially unwanted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional threat detection methods decrypt and execute executable files to analyze behavior, then detection accuracy is improved, but system safety deteriorates and analysis time increases
Solution Approach 1:
The system performs static analysis on executable files before they are executed, extracting features from file headers, sections, and metadata without decrypting or running the code. This preliminary examination allows threat detection to occur prior to potential system compromise, maintaining safety while achieving accurate classification of malicious versus benign files.
2Reliability
If executable files are decrypted and executed for analysis, then threat detection capability is improved, but analysis time increases
Solution Approach 1:
The system extracts only the necessary static features from executable files—such as header information, section characteristics, import tables, and metadata—without performing full decryption or execution. This selective extraction of critical attributes enables rapid analysis while maintaining reliable threat detection capability.
3Measurement precision
If executable files are executed to detect threats, then detection thoroughness is improved, but false positive rate increases
Solution Approach 1:
The system performs comprehensive static analysis before execution, examining file structure, headers, sections, and metadata to identify malicious patterns. By conducting thorough preliminary examination without execution, the system achieves detection completeness while avoiding the false positives that arise from observing malicious behavior in controlled execution environments.
Data Source
AI summary
Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.