Filename Extension Embeddings for Malicious Rename Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to accurately detect and prevent ransomware attacks that employ randomized modifications to file properties, such as filename extensions, due to the inability to generalize filenames or extensions used by newer, unrecognized ransomware families or versions.
Innovation Solution
Employing a machine learning model, specifically a Convolutional Neural Network (CNN), to create feature vectors for filename or filename extensions and generate embedding representations, enabling the prediction of malicious modifications by evaluating these vectors against trained benign and malicious patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional file extension detection methods are used, then detection simplicity is maintained, but detection accuracy deteriorates against randomized ransomware modifications
Solution Approach 1:
The patent replaces traditional mechanical/file-based detection methods with a machine learning-based neural network system. The neural network processes file extensions and filenames through trained models to predict ransomware modifications, substituting simple rule-based approaches with intelligent computational systems that achieve higher accuracy against randomized attacks.
2Adaptability or versatility
If known ransomware patterns are used for detection, then detection reliability is improved, but adaptability to new ransomware variants deteriorates
Solution Approach 1:
The patent applies preliminary action by training the neural network model in advance on comprehensive datasets containing both benign and malicious file patterns. This pre-training enables the system to generalize to new ransomware variants without requiring real-time updates, as the model has already learned underlying patterns during the preliminary training phase.
Solution Approach 2:
The patent changes the detection parameters from fixed rule-based thresholds to dynamic neural network predictions. The system uses probability scores and confidence levels from the trained model to adaptively determine maliciousness, allowing reliable detection across diverse ransomware variants through parameter-based decision making rather than rigid rules.
3Measurement precision
If comprehensive file analysis is performed, then detection precision is improved, but processing speed deteriorates
Solution Approach 1:
The patent extracts only the critical features needed for detection—specifically file extensions and filenames—rather than performing comprehensive analysis of entire files. The neural network processes these extracted textual features to achieve high detection precision while maintaining fast processing speeds, as the analysis is limited to specific string patterns rather than full file contents.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A feature vector is created that comprises a plurality of values, each representing a corresponding portion of a filename extension for a digital file. During an inference workflow of a neural network model, an embedding vector is created that represents, in a meaningful way, the feature vector for the filename extension. A class label prediction value is then computed, based on an evaluation of the embedding vector, a first plurality of embedding vectors representing a plurality of feature vectors for a plurality of benign filename extensions, and a second plurality of embedding vectors representing a plurality of feature vectors for a plurality of malicious filename extensions. A prediction as to whether the digital file has been renamed by a malicious computer program is made, based on the class label prediction value.