Malware Classification via ICA Signal Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in effectively separating malware events from background noise in traffic data, which hinders accurate malware classification and containment.
Innovation Solution
A computing device processes traffic data into feature vectors using n-gram analysis and independent component analysis (ICA) signal processing algorithms, associated with specific malware families, to separate malware events from background noise, followed by classification using machine learning algorithms to determine scores and apply labels for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signal processing algorithms are used to separate malware events from background noise, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The system segments the mixed traffic data into separate malware events and background noise components using independent component analysis (ICA). The ICA algorithm decomposes the observed mixed signals into statistically independent source signals, effectively separating malware events from background traffic without requiring complex manual filtering rules
Solution Approach 2:
The patent introduces an intermediary signal processing layer (ICA algorithm) that acts as a mediator between the raw mixed traffic data and the malware classification system. This intermediary component handles the complexity of separation, allowing the classification system to work with cleaner, pre-separated features
2Adaptability or versatility
If multiple signal processing algorithms are applied to handle different malware families, then adaptability is improved, but device complexity increases
Solution Approach 1:
The independent component analysis algorithm serves as a universal, malware-family-agnostic separation mechanism that can handle different types of malware traffic. The same ICA framework is applied across multiple malware families, with each family having its own classification model trained on the separated features, rather than requiring separate separation algorithms for each family
Data Source
AI summary
Embodiments relate to systems, devices, and computing-implemented methods for separating malware and background events to classify malware based on traffic data by receiving the traffic data that includes malware events and background noise, converting the traffic data into a feature vector, performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, where the signal processing algorithm is associated with a malware family, determining a score for the malware events using a malware classification algorithm associated with the malware family, and applying a label associated with the malware family to the traffic data based on the score to classify the traffic data. Additionally, the malware application can be contained, removed, and/or the effects of a malware application can be neutralized based on the classification.