Feature Extraction for Malicious Code Detection in Smart Terminals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile phone protection technologies face challenges in accurately and efficiently constructing a feature library to detect malicious codes, as they lack effective methods for feature extraction.
Innovation Solution
A method and device for feature extraction that involves acquiring black and white sample files from an intelligent terminal's application layer, parsing files to determine function information structures, calculating check codes, and counting the occurrence of functions to extract unique features for both black and white sample files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional feature extraction methods are used for mobile phone security, then the feature library construction is incomplete or inaccurate, but the detection efficiency and accuracy of malicious codes deteriorates
Solution Approach 1:
The patent segments the feature extraction process into distinct functional modules: file acquisition unit, parsing unit, check code calculation unit, counting unit, and extraction unit. Each module handles a specific aspect of feature extraction, enabling systematic and efficient processing of sample files while maintaining high accuracy in identifying malicious code features.
Solution Approach 2:
The patent performs preliminary parsing of sample files to extract function information structures and calculates check codes in advance. This preliminary action creates a structured foundation that accelerates subsequent feature extraction and detection processes, improving overall detection efficiency without sacrificing accuracy.
2Reliability
If comprehensive feature extraction is performed on all sample files, then the feature library becomes more complete, but the processing time and computational resources increase
Solution Approach 1:
The patent extracts only the essential function information structures and check codes from sample files, rather than processing all file contents comprehensively. This selective extraction maintains feature library completeness by capturing the most relevant features while significantly reducing processing time and computational resource requirements.
Solution Approach 2:
The patent transforms the complex file analysis problem into a more efficient parameter-based approach by converting function information into check codes and counting occurrences. This parameter transformation enables rapid comparison and feature identification, achieving comprehensive feature extraction with reduced processing time.
3Measurement precision
If function occurrence counting is performed for all functions in sample files, then the feature extraction accuracy improves, but the computational complexity increases
Solution Approach 1:
The patent creates simplified representations (copies) of function information through check codes that capture the essential characteristics of functions without requiring full function analysis. This copying approach maintains extraction accuracy by preserving key identifying features while dramatically reducing computational complexity of comparison operations.
Data Source
AI summary
Provided are a method and device for feature extraction. The method comprises: acquiring a batch of black sample files and white sample files from an application layer of a smart terminal operating system; parsing each file, acquiring information structure of all functions contained in each file, and computing a checksum for each function; determining whether or not the files contain the functions corresponding to the checksums, thus compiling statistics on the number of occurrences of each function in the black sample files and the white sample files; and, extracting a black sample feature on the basis of functions occurring only in the black sample files and not occurring in the white sample files, or extracting a white sample feature on a similar basis.