Graph-Based Malware Classification via Static and Dynamic Data Fusion

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional malware detection methods, particularly signature-based approaches, are inadequate in identifying polymorphic and code-obfuscated malware due to their reliance on static patterns, which limits their effectiveness against evolving threats.

Innovation Solution

The use of graph-based classification techniques that generate graph representations from dynamic and static data sources, employing Markov chains and kernel methods to analyze instruction traces, allowing for the classification of malware by capturing behavioral patterns and structural similarities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If signature-based detection tools are used, then detection speed is fast, but detection accuracy deteriorates against polymorphic and obfuscated malware

Engineering Contradiction:

Improvedetection speedVSAvoiddetection accuracy

Core Design Contradiction:

SpeedVSMeasurement precision

Solution Approach 1:

The patent transitions from static signature-based detection to dynamic behavior-based detection. The system executes malware samples in a controlled environment and collects dynamic behavior data (system calls, registry changes, file operations) to classify malware, enabling accurate detection of polymorphic and obfuscated variants that evade static signatures.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent changes the detection parameters from fixed signatures to dynamic behavior metrics. By collecting and analyzing runtime behavior parameters such as system call sequences, registry modifications, and file operation patterns, the system adapts to malware variations while maintaining detection accuracy.

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If multiple data sources are integrated for classification, then classification accuracy is improved, but system complexity increases

Engineering Contradiction:

Improveclassification accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the malware analysis process into distinct modules: static analysis module (extracting code characteristics), dynamic analysis module (collecting behavior data), graph construction module (building execution flow graphs), and classification module (training and predicting). This segmentation allows each module to process specific data types independently before integrating them for comprehensive classification.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent merges multiple data sources (static code features, dynamic behavior traces, execution flow graphs) into a unified classification framework. By combining these diverse data types and representing them in a common graph structure, the system achieves high classification accuracy while managing complexity through integrated processing.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS9021589B2Integrating multiple data sources for malware classification

Publication Date: 2015.04.28 TRIAD NATIONAL SECURITY LLC

AI summary

Disclosed herein are representative embodiments of tools and techniques for classifying programs. According to one exemplary technique, at least one graph representation of at least one dynamic data source of at least one program is generated. Also, at least one graph representation of at least one static data source of the at least one program is generated. Additionally, at least using the at least one graph representation of the at least one dynamic data source and the at least one graph representation of the at least one static data source, the at least one program is classified.