Image-Based Malware Detection for Variant Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection technologies struggle to effectively analyze and respond to advanced persistent threats (APTs) and variant malicious codes in real-time, particularly within endpoint devices, due to reliance on signature-based methods and insufficient analysis of malicious code inside agents.
Innovation Solution
An image-based malware detection method and apparatus that utilize deep learning analysis on byte arrays converted from execution files, minimizing memory resource allocation and bypassing antivirus software, while performing proactive responses and dynamic analysis of remote behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection methods are used, then detection accuracy for known malware is improved, but the ability to detect new and variant malicious codes in real-time deteriorates
Solution Approach 1:
The patent transforms malware detection from signature-based to image-based deep learning by changing the fundamental parameter of analysis. Execution files are converted into image representations, allowing deep learning models to detect patterns and features that traditional signature methods cannot identify, thereby improving detection of new and variant malware while maintaining real-time performance
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an intelligent image recognition system using deep learning. By substituting traditional rule-based detection with neural network-based image analysis, the system achieves both high accuracy for known malware and adaptability for new threats through automated feature extraction and pattern recognition
2Measurement precision
If deep learning analysis is performed on execution files, then malware detection accuracy is improved, but memory resource allocation increases
Solution Approach 1:
The patent extracts only the essential features needed for malware detection by converting execution files into compressed image representations. This extraction process removes unnecessary data while preserving critical patterns, allowing deep learning models to operate with reduced memory requirements compared to analyzing complete execution files
Solution Approach 2:
The patent transforms one-dimensional byte sequences into two-dimensional image structures, enabling more efficient feature representation and processing. This dimensional transformation allows the deep learning model to leverage spatial relationships in the data, improving detection accuracy while optimizing memory usage through compact image formats
3Speed
If real-time analysis of all endpoint events is performed, then threat detection speed is improved, but system load increases
Solution Approach 1:
The patent applies partial action by performing deep learning analysis selectively on suspicious files identified through initial filtering, rather than analyzing all endpoint events uniformly. This approach maintains high threat detection speed for critical cases while reducing overall system load through intelligent resource allocation
Solution Approach 2:
The patent implements preliminary filtering and preprocessing of endpoint events before applying computationally intensive deep learning analysis. By pre-identifying suspicious files and preparing their image representations in advance, the system achieves fast real-time detection when needed while minimizing peak system load through staged processing
Data Source
AI summary
Disclosed is a method and device for image-based malware detection, and artificial intelligence-based endpoint detection and response system using same. The method includes the steps of: reading, as bytes of an unsigned integer of constant bits, an executable file or at least a portion of the code of an executable file located in a file path of a generated file obtained from a file generation event log detected in an EDR system or a processor, a memory, or a storage device associated with an endpoint, and converting same into a byte array; reading two bytes at a time from the byte array; using the two bytes of data as coordinates of an image of a preset size to increase a corresponding coordinate value, and adding an RGB channel to store an image array; and performing deep learning analysis using an image deep learning model on the image array.