Hierarchical Server Malware Detection with ML Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods relying on signatures struggle to keep pace with the rapid generation and distribution of new malware, often failing to detect new threats before updates are disseminated to users.
Innovation Solution
Implementing a machine learning-based file classifier that uses features derived from binary files to distinguish between malware and non-malware, capable of identifying patterns and detecting 'zero-day' malware without prior training, and integrating this with a hierarchical server system for efficient classification and load balancing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then detection accuracy for known malware is improved, but detection speed and effectiveness against new malware deteriorates due to the time required for definition updates
Solution Approach 1:
The system performs preliminary analysis by extracting features from malware samples and training classification models in advance. When new malware is encountered, the pre-trained models can immediately classify it based on learned patterns, eliminating the time delay associated with waiting for signature updates. The hierarchical structure allows enterprise servers to have pre-configured models that can rapidly assess new threats.
Solution Approach 2:
The patent introduces a hierarchical server structure with master servers and enterprise servers as intermediaries. Enterprise servers act as intermediaries between end-user devices and master servers, caching classification models and malware definitions locally. This intermediary layer enables rapid detection at the enterprise level while still benefiting from centralized model updates, thus reducing the time delay for new malware detection.
2Adaptability or versatility
If machine learning-based file classification is implemented, then detection capability against zero-day malware is improved, but computational complexity and resource requirements increase
Solution Approach 1:
The system segments the malware detection functionality into distinct components: feature extraction modules, classification model training modules, and inference modules. The hierarchical server structure further segments the system into master servers (for model training and distribution) and enterprise servers (for local inference). This segmentation reduces overall system complexity by allowing each component to be optimized independently and distributed across the hierarchy.
Solution Approach 2:
The patent transitions from traditional single-layer malware detection to a hierarchical multi-dimensional architecture. By adding the enterprise server layer between end devices and master servers, the system creates a new dimensional structure that distributes computational complexity across multiple levels. Enterprise servers handle local inference tasks while master servers handle model training, effectively managing complexity through dimensional expansion.
3Stability of the object's composition
If centralized malware definition distribution is used, then consistency across systems is improved, but network bandwidth consumption and update time increase
Solution Approach 1:
The system implements local quality by allowing enterprise servers to maintain local caches of classification models and malware definitions tailored to their specific enterprise environment. Rather than forcing all systems to use identical centralized definitions, each enterprise server can store and use locally-relevant detection data, reducing the need for frequent full synchronization and thereby reducing network bandwidth consumption while maintaining consistency for critical updates.
Solution Approach 2:
Master servers perform preliminary actions by training classification models and preparing malware definition updates in advance, then distributing them to enterprise servers. Enterprise servers pre-cache these updates locally, so when new malware threats emerge, the detection capabilities are already in place without requiring real-time network communication. This preliminary action reduces both network bandwidth consumption and update time.
Data Source
AI summary
A method includes receiving, at a first server from a second server, a first file attribute associated with a file. The method includes making a determination, at the first server based on the first file attribute, of availability of a classification for the file from a cache of the first server. The method includes, in response to the determination indicating that the classification is not available from the cache, sending a notification to the second server indicating that the classification for the file is not available. The method also includes receiving a first classification for the file from the second server at the first server. The first classification is generated by the second server responsive to the notification.