File Harmfulness Coefficient via Learning Model Attribute Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious files are ineffective in detecting similar files based on a single identified malicious file, especially in advanced persistent threat (APT) attacks, where files may be signed with trusted certificates and exhibit non-malicious actions, making it difficult to distinguish between safe and harmful files.
Innovation Solution
A learning model is trained using vectors of attributes from known malicious and safe files to determine a coefficient of harmfulness, identifying significant and insignificant attributes, and generating rules for detecting malicious files, which includes using a neural network to analyze unknown files and output a numerical value indicating their harmfulness probability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature and heuristic analysis methods are used to identify malicious files, then detection of known malicious files is effective, but detection of similar malicious files (especially in APT attacks) fails when files are signed with trusted certificates and exhibit non-malicious actions
Solution Approach 1:
The system performs preliminary analysis of a known malicious file to extract its attribute vector and train a learning model before encountering similar files. This preliminary training enables the system to recognize patterns and relationships in malicious file attributes, allowing it to detect similar files even when they have trusted certificates or exhibit non-malicious actions. The learned model is stored and reused for subsequent detection tasks.
Solution Approach 2:
The system transforms the malicious file detection problem into a parameter-based classification task by extracting multiple attributes (parameters) of the file and using a learning model to determine a harmfulness coefficient. Instead of relying on fixed signatures or simple heuristics, the system analyzes multiple parameters simultaneously and uses machine learning to weigh their significance, enabling detection of subtle patterns that distinguish malicious from benign files.
2Loss of information
If virtual machine sandboxing is used to analyze file behavior, then detailed behavior analysis is possible, but the system cannot effectively identify malicious files based on a single identified malicious file sample
Solution Approach 1:
The system extracts the essential characteristics and attributes from a single known malicious file sample, creating an attribute vector that captures the file's defining features. Instead of requiring multiple samples or extensive behavioral analysis in a sandbox, the system takes out and isolates the key discriminative attributes that characterize the malicious file, then uses these extracted features to train a learning model for detecting similar files.
3Reliability
If all file attributes are analyzed to determine harmfulness, then comprehensive detection is achieved, but computing resources are wasted on insignificant attributes
Solution Approach 1:
The system performs partial analysis by focusing only on the most significant attributes for malicious file detection. The learning model identifies and prioritizes the subset of attributes that have the greatest impact on harmfulness determination, allowing the system to achieve effective detection without analyzing every possible file attribute. This selective approach reduces computing resource consumption while maintaining detection reliability.
Data Source
AI summary
Disclosed herein are systems and methods for determining a coefficient of harmfulness of a file using a trained learning model. In one aspect, an exemplary method includes forming a first vector containing a plurality of attributes of a known malicious file. A learning model is trained using the first vector to identify a plurality of significant attributes that influence identification of the malicious file. A second vector is formed containing a plurality of attributes of known safe files. The learning model is trained using the second vector to identify attributes insignificant to the identification of the malicious file. An unknown file is analyzed by the learning model. The learning model outputs a numerical value identifying a coefficient of harmfulness relating to a probability that the unknown file will prove to be harmful.