Goodware Model Pruning for Malware Signature Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware signature generation methods face computational challenges and high false positive rates due to the large size of goodware datasets and characteristics, making it inefficient to identify and store occurrence rates for all characteristics.
Innovation Solution
A computer-implemented method generates a model specifying the likelihood of observing characteristics in a set of goodware entities, using relative information gain values to prune sequences and reduce redundancy, thereby generating scalable malware signatures with reduced false positive detections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware signatures are validated against a large dataset of all known goodware to reduce false positives, then the accuracy of malware detection is improved, but the computational cost and time required for signature generation increases significantly
Solution Approach 1:
The patent segments the large goodware dataset into multiple subsets or partitions. Instead of validating against the entire dataset at once, the validation process is divided into smaller, manageable segments that can be processed independently and in parallel, reducing the computational time and resource requirements while maintaining detection accuracy.
Solution Approach 2:
The patent performs preliminary analysis and preprocessing of the goodware dataset before actual signature validation. This includes pre-computing statistical profiles, creating condensed representations of goodware characteristics, and preparing reference data structures in advance. This preliminary action reduces the computational burden during the actual signature generation and validation phase.
2Measurement precision
If occurrence rates are calculated for all possible characteristics in the large set of goodware to generate accurate malware signatures, then the precision of signature generation is improved, but the storage requirements and processing complexity becomes untractable
Solution Approach 1:
The patent extracts only the most relevant and discriminative characteristics from the large set of all possible goodware characteristics. Instead of computing occurrence rates for every possible characteristic, the system identifies and extracts a subset of key characteristics that provide the most information for malware detection, thereby reducing storage requirements and processing complexity while maintaining precision.
Solution Approach 2:
The patent changes the parameter representation from storing raw occurrence rates for all characteristics to using condensed statistical profiles or aggregated metrics. This parameter transformation reduces the dimensionality of the data while preserving the essential information needed for accurate signature generation.
3Reliability
If a comprehensive model including all characteristics with their likelihood values is maintained to minimize false positives, then the reliability of malware detection is improved, but the model size and processing overhead increases
Solution Approach 1:
The patent implements partial action by maintaining and using only the most critical portions of the goodware model during runtime. Instead of loading and processing the complete model with all characteristics, the system selectively accesses and applies only the subset of model data that is most relevant for detecting the specific malware being analyzed, reducing model size and processing overhead while maintaining detection reliability.
Data Source
AI summary
A set of likelihood values associated with a set of characteristics associated with the set of goodware entities is determined. The set of characteristics is stored in association with the set of likelihood values as a model. A set of relative information gain values associated with the characteristics of the set of characteristics is generated. One or more characteristics are removed from the model responsive to the relative information gain values associated with the one or more characteristics to produce a revised model.