Hierarchical Neural Network for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems, particularly signature-based algorithms, struggle to detect polymorphic malware and zero-day attacks due to their reliance on pre-existing threat signatures, making it difficult to identify new or evolving threats.
Innovation Solution
A hierarchical neural network classifier that aggregates traffic flows into 'bags' to extract features, combining them into user-level vectors for classification, allowing for the detection of malware without requiring individual connection labels, and learns patterns from traffic logs to distinguish between benign and malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based algorithms are used to detect threats, then known threats can be identified accurately, but new or polymorphic threats cannot be detected
Solution Approach 1:
The system performs preliminary actions by collecting and storing network traffic data before threats emerge, creating a foundation of normal behavior patterns. This allows the anomaly detection system to identify new threats by comparing against pre-established baselines without requiring pre-existing threat signatures
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an intelligent anomaly detection system using machine learning. Instead of mechanically comparing byte sequences against stored signatures, the system uses algorithms to learn normal behavior patterns and automatically detect deviations, enabling detection of previously unseen threats
2Measurement precision
If traffic data is analyzed at individual connection level, then detailed threat detection is possible, but large amounts of human-labeled data are required
Solution Approach 1:
The system merges multiple individual connection-level traffic data points into aggregated traffic flow representations. By combining information from multiple connections into unified traffic flow objects, the system reduces the dimensionality of the data and consequently reduces the amount of labeled data needed for effective model training while preserving essential threat detection capabilities
Solution Approach 2:
The patent transforms the data from individual connection level to traffic flow level, adding an aggregation dimension. This dimensional transformation groups multiple connections into flows, reducing the complexity and data requirements for training while maintaining detection precision through the preserved flow-level patterns
Data Source
AI summary
Presented herein are techniques for classifying devices as being infected with malware based on learned indicators of compromise. A method includes receiving at a security analysis device, traffic flows from a plurality of entities destined for a plurality of users, aggregating the traffic flows into discrete bags of traffic, wherein the bags of traffic comprise a plurality of flows of traffic for a given user over a predetermined period of time, extracting features from the bags of traffic and aggregating the features into per-flow feature vectors, aggregating the per-flow feature vectors into per-destination domain aggregated vectors, combining the per-destination-domain aggregated vectors into a per-user aggregated vector, and classifying a computing device used by a given user as infected with malware when indicators of compromise detected in the bags of traffic indicate that the per-user aggregated vector for the given user includes suspicious features among the extracted features.