Hardware Performance Counter Event Selection for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods require significant human analysis and trial-and-error to identify the optimal set of hardware performance counter events, making it inefficient and prone to missing detections as malware can evolve and change deployment strategies.
Innovation Solution
An automated process using artificial intelligence, specifically a three-part method involving individual, joint, and deep event selection processes, which includes feature analysis, machine learning analysis, and a genetic algorithm to rank and select the best combinations of hardware performance counter events for malware detection and classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If brute force method is used to find the best HPC event combination, then detection accuracy may be improved by testing all combinations, but the time and computational resources required become practically infeasible
Solution Approach 1:
The patent segments the event selection process into three distinct phases: individual event selection (ranking events by information gain), joint event selection (evaluating pairs of events), and deep event selection (using genetic algorithms for optimization). This segmentation transforms the infeasible brute-force approach into a manageable multi-stage process that achieves high detection accuracy without requiring exhaustive testing of all possible combinations.
Solution Approach 2:
The patent applies preliminary action by first ranking individual HPC events based on information gain before forming combinations. This pre-filtering step reduces the search space significantly, allowing the system to focus computational resources on evaluating only the most promising event combinations rather than testing all possible combinations from scratch.
2Measurement precision
If human analysis and trial-and-error are used to select HPC events, then detection capability can be improved through expert knowledge, but the process requires significant human resources and time
Solution Approach 1:
The patent implements self-service by automating the entire HPC event selection process using artificial intelligence. The system autonomously performs individual event selection, joint event selection, and deep event selection without requiring human analysts to manually review malware and event documents. The AI system uses information gain calculations, machine learning models, and genetic algorithms to automatically identify the optimal event set for detecting malware classes.
Solution Approach 2:
The patent replaces the mechanical system of human analysis with an automated AI-based system. Instead of human experts manually correlating malware behavior with HPC events through trial and error, the system uses computational methods including information gain ranking, random forest classifiers, and genetic algorithms to automatically select events, thereby eliminating the need for significant human resources while maintaining or improving detection capability.
3Ease of manufacture
If a static Machine Learning model is used for malware detection, then the model structure is simple and easy to implement, but malwares can skip detection by changing deployment strategies
Solution Approach 1:
The patent applies dynamics by implementing a multi-stage event selection process that can adapt to different malware classes. The system dynamically selects the most relevant HPC events for each specific malware class through individual event selection, joint event selection, and deep event selection using genetic algorithms. This dynamic adaptation allows the system to maintain high detection accuracy against evolving malware while keeping the actual detection model structure relatively simple.
Data Source
AI summary
A method comprises generating a first set of hardware performance counter (HPC) events that is ranked based on an ability of an individual HPC event to profile a malware class, generating a second set of HPC event combinations that is ranked based on an ability of a set of at least two joint HPC events to profile a malware class, generating a third set of extended HPC event combinations, profiling one or more malware events and one or more benign applications to obtain a detection accuracy parameter for each malware event, applying a machine learning model to rank the third set of HPC event combinations based on malware detection accuracy, and applying a genetic algorithm to the third set of HPC event combinations to identify a subset of the third set of extended combinations of HPC events to be used for malware detection and classification.