Hybrid Deep Learning Malware Classifier with Explainability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware classification methods lack explainability, making it difficult to understand how classifications are made and reducing confidence in security decisions, while also being slow and inefficient in processing and training.
Innovation Solution
A hybrid deep learning model combining convolutional neural networks with multi-layer perceptron topology is used to classify malware, incorporating malware identification rules and attack techniques, which provides explainability by pinpointing significant features in the classification process and enabling agile deployment of new models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional malware classification methods are used, then processing speed is slow, but explainability is poor
Solution Approach 1:
The patent segments the malware classification process into distinct functional modules: feature extraction module that identifies significant code features, classification module that processes features rapidly, and explanation generation module that produces human-readable justifications. This segmentation allows each module to be optimized independently, achieving both high processing speed and maintainable explainability.
Solution Approach 2:
The patent introduces an intermediary explanation layer that translates the outputs of fast neural network classifiers into human-understandable justifications. This intermediary component bridges the gap between rapid automated classification and comprehensible security decision-making, allowing security analysts to understand why malware was classified without sacrificing processing speed.
2Measurement precision
If complex deep learning models are used to improve classification accuracy, then processing becomes slower, but if simpler models are used, then accuracy decreases
Solution Approach 1:
The patent performs preliminary feature extraction and selection before the main classification process, pre-processing the malware code to identify only the most significant features. This preliminary action reduces the dimensionality of input data, allowing simpler and faster models to achieve high accuracy without processing redundancy.
Solution Approach 2:
The patent applies different processing qualities to different parts of the classification system: high-complexity feature extraction for accuracy-critical stages, and optimized lightweight classification for speed-critical stages. This local quality differentiation ensures high accuracy where needed while maintaining processing efficiency in other areas.
3Measurement precision
If more features are extracted to improve classification accuracy, then processing complexity increases, but if fewer features are used, then classification accuracy decreases
Solution Approach 1:
The patent extracts and isolates only the most discriminative features from malware code, removing irrelevant and redundant information. This selective extraction process reduces feature dimensionality while preserving the information necessary for accurate classification, thereby reducing processing complexity without sacrificing accuracy.
Solution Approach 2:
The patent extracts more features than traditionally necessary and then applies dimensionality reduction techniques to select the optimal subset. This partial action approach ensures that sufficient features are captured for high accuracy while the selection process eliminates excess features that would increase complexity.
Data Source
AI summary
Apparatus, systems, and methods to classify malware with explainability are disclosed. An example apparatus includes at least one memory; instructions in the apparatus; and processor circuitry. The example processor circuitry is to execute the instructions to: generate feature vectors from a first input; train a neural network model using a first portion of the feature vectors; add one or more fully connected layers to the trained neural network model to form a hybrid model; validate the hybrid model using a second portion of the feature vectors; and deploy the validated hybrid model as a malware classifier, the malware classifier to provide a malware classification with explainability in response to a second input.