File Classification via Cluster Metadata Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional systems for classifying files face challenges in efficiently handling large numbers of suspicious or unknown files, particularly due to polymorphism, which overwhelms computing and labor resources, and requires improved methods for accurate classification.
Innovation Solution
The proposed system employs a computer-implemented method that identifies file clusters through statistical analysis, leverages ground truth files with assigned security scores, and assigns security scores to unknown files based on shared metadata, using a machine learning model to determine overall security scores for clusters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file classification methods are used to identify and analyze suspicious files, then security classification accuracy is maintained, but computing resources and labor are overwhelmed due to the large number of suspicious files
Solution Approach 1:
The patent segments the file classification problem by dividing suspicious files into clusters based on co-occurrence patterns and shared metadata. Instead of analyzing each file individually, the system groups related files together, reducing the overall number of classification decisions needed while maintaining security accuracy through cluster-level analysis.
Solution Approach 2:
The system performs preliminary clustering and metadata analysis before full security classification. By pre-identifying file relationships and shared characteristics, the system prepares data structures that enable faster subsequent classification without compromising detection accuracy.
2Measurement precision
If manual inspection by security experts is used to classify suspicious files, then classification accuracy is improved, but the process becomes time-consuming and resource-intensive
Solution Approach 1:
The system enables self-service classification by automatically analyzing file metadata, co-occurrence patterns, and cluster relationships to generate security classifications. This automated self-service approach reduces dependence on manual expert inspection while maintaining high classification accuracy through multiple validation mechanisms.
Solution Approach 2:
The system implements feedback loops where classification results from ground truth files and previously analyzed files inform the classification of new suspicious files. This feedback mechanism allows the system to learn from past classifications and improve accuracy over time without requiring continuous manual expert intervention.
3Reliability
If security software products analyze every suspicious file in detail, then detection accuracy is maintained, but computing resources are overwhelmed
Solution Approach 1:
The system applies local quality analysis by focusing detailed security analysis only on representative files within each cluster rather than every file. By identifying key representative files that capture the essential characteristics of a cluster, the system maintains detection accuracy while significantly reducing overall computing resource consumption.
Solution Approach 2:
The system uses metadata and co-occurrence information as proxies or copies of actual file content for initial analysis. By analyzing lightweight metadata attributes and relationship patterns rather than full file contents, the system achieves efficient preliminary screening that maintains detection capability while reducing computational overhead.
Data Source
AI summary
A computer-implemented method for file classification may include (1) identifying, by a computer security system, a cluster of files that co-occur with each other according to a statistical analysis, (2) identifying ground truth files to which the computer security system has previously assigned a security score, (3) determining that a file in the cluster of files shares an item of file metadata with another file in the ground truth files, (4) assigning a security score to the file in the cluster of files based on a security score of the other file in the ground truth files that shares the item of file metadata, and (5) assigning an overall security score to the entire cluster of files based on the security score assigned to the file in the cluster. Various other methods, systems, and computer-readable media are also disclosed.