Feature Equivalence Threshold for Malicious Document Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious digital documents are inefficient due to the need for large datasets and unwieldy feature sets, which can lead to inefficiencies and high computational costs, and often fail to distinguish between benign and malicious documents accurately.
Innovation Solution
A computer-implemented method that uses entity resolution to merge syntactically disparate features that are semantically equivalent, reducing the feature set size while maintaining high classification accuracy by monitoring system calls during document processing and establishing a whitelist of benign features to identify malicious documents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus systems use large curated databases of byte-signatures for detection, then detection coverage is improved, but system complexity and computational overhead increase significantly
Solution Approach 1:
The patent merges multiple detection approaches (byte-signature matching, static feature analysis, and dynamic behavior monitoring) into a unified detection system. This consolidation reduces overall system complexity while maintaining comprehensive detection coverage by having the components work together rather than separately.
Solution Approach 2:
The patent extracts and focuses on the most critical detection features from large datasets, creating a streamlined set of key indicators for malicious document detection. This extraction process reduces computational overhead while preserving detection effectiveness by eliminating redundant analysis.
2Measurement precision
If machine learning models are trained on large corpora of malicious and benign documents, then classification accuracy is improved, but training time and computational resources increase
Solution Approach 1:
The patent extracts and utilizes pre-computed features from training documents, avoiding redundant feature extraction during training. This approach significantly reduces training time while maintaining classification accuracy by leveraging previously processed feature data.
Solution Approach 2:
The patent performs feature extraction and initial analysis as preliminary steps before the actual training process. By preparing the data in advance and organizing features beforehand, the training phase becomes more efficient and requires less computational time while achieving the same accuracy levels.
3Speed
If static feature analysis is used to detect anomalies in documents, then detection speed is improved, but accuracy in distinguishing malicious from benign documents decreases
Solution Approach 1:
The patent merges static feature analysis with dynamic behavior monitoring to create a hybrid detection approach. This combination maintains the speed advantage of static analysis while adding the accuracy benefits of dynamic observation, resolving the trade-off between detection speed and accuracy.
Solution Approach 2:
The patent introduces a feature equivalence threshold mechanism as an intermediary layer between static feature extraction and malicious document classification. This intermediary process refines the static features by comparing them against learned equivalence thresholds, improving accuracy without significantly impacting detection speed.
4Reliability
If feature sets are expanded to capture more document characteristics, then detection comprehensiveness is improved, but computational overhead and processing time increase
Solution Approach 1:
The patent extracts and retains only the most discriminative features from comprehensive feature sets, removing redundant or less informative features. This feature selection process reduces computational overhead while preserving detection comprehensiveness by focusing on the most relevant characteristics.
Solution Approach 2:
The patent dynamically adjusts feature equivalence thresholds based on the specific detection context and document type. This parameter adaptation allows the system to maintain comprehensive detection coverage while reducing computational overhead by applying less stringent equivalence checks when appropriate.
Data Source
AI summary
A method includes, as part of establishing a feature merging threshold (α) for determining equivalence between two features, selecting a set of candidate α values, partitioning training data into a plurality of groups, establishing a model Wα for each α value of the set of candidate α values, iteratively performing: selecting a next group of training data of the plurality of groups of training data; adding the selected next group of training data to a training set; and for each α value in the set of candidate α values: training the Wα for the α value using the training set, and evaluating a size of Wα, the size comprising a number of features included in the model, and choosing the feature merging threshold α based on the iteratively performing.