Image-Based Malware Detection for Unknown Threats in EDR
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint detection and response (EDR) systems struggle to effectively analyze and respond to advanced persistent threats (APTs) and new/variant malicious codes, particularly those that bypass antivirus software, due to reliance on signature-based methods and insufficient real-time detection capabilities.
Innovation Solution
An image-based malware detection method and apparatus that utilizes deep learning analysis on byte arrays converted from execution files, minimizing memory resource allocation and enabling proactive detection of unknown threats through image-based classification and machine learning, with features like automatic backup and threat intelligence distribution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection methods are used, then detection accuracy for known malware is improved, but the ability to detect new and variant malicious codes deteriorates
Solution Approach 1:
The patent replaces traditional signature-based detection mechanisms with deep learning-based image analysis. Malware binaries are converted to image representations and analyzed using pre-trained deep learning models, substituting the mechanical signature-matching system with an AI-based visual analysis system that can generalize to new and variant malware without requiring updated signatures.
Solution Approach 2:
The patent transforms the malware detection parameter space by converting binary code data into image domain representations. This parameter transformation enables the use of image-based deep learning features for malware classification, allowing detection based on visual patterns in the code structure rather than fixed signature strings, thereby improving adaptability to new malware variants.
2Adaptability or versatility
If deep learning analysis is performed on malware files, then detection capability for unknown threats is improved, but memory resource allocation and system load increase
Solution Approach 1:
The patent applies pre-trained deep learning models that have already learned malware features during offline training. During runtime detection, the model parameters are fixed and no training computation is performed, only inference. This preliminary action of pre-training transfers the computational burden to an offline phase, reducing memory and processing requirements during actual malware detection operations.
Solution Approach 2:
The patent converts malware binary data into image representations (copies of the data in a different format). This copying process transforms the input data into a form that can be efficiently processed by image-based deep learning models, leveraging existing image processing infrastructure and reducing the need for specialized malware analysis computational resources.
3Loss of time
If real-time analysis of malicious code is performed, then response time to threats is improved, but system performance and productivity deteriorate
Solution Approach 1:
The patent replaces computationally intensive traditional malware analysis methods with optimized deep learning inference. The image-based approach leverages efficient convolutional neural network operations that can process malware samples rapidly, achieving real-time detection speeds while maintaining lower computational overhead compared to exhaustive static or dynamic analysis methods.
Data Source
AI summary
Disclosed is a method and device for image-based malware detection, and artificial intelligence-based endpoint detection and response system using same. The method includes the steps of: reading, as bytes of an unsigned integer of constant bits, an executable file or at least a portion of the code of an executable file located in a file path of a generated file obtained from a file generation event log detected in an EDR system or a processor, a memory, or a storage device associated with an endpoint, and converting same into a byte array; reading two bytes at a time from the byte array; using the two bytes of data as coordinates of an image of a preset size to increase a corresponding coordinate value, and adding an RGB channel to store an image array; and performing deep learning analysis using an image deep learning model on the image array.