Automated IOC Extraction and Classification for Malware Detection
Solution Overview
Problem
Existing techniques struggle to effectively detect and prevent malware, particularly due to the increasing sophistication of malware authors in obfuscating their software, leading to a need for improved detection and prevention methods.
Innovation Solution
The development of an automated system for extracting and classifying malicious indicators, which includes a data appliance capable of enforcing policies and an automated indicator of compromise extraction system that collects and classifies indicators automatically using a combination of heuristic and machine learning classifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated extraction and classification systems are implemented, then detection efficiency and productivity improve, but device complexity and implementation difficulty increase
Solution Approach 1:
The system is divided into distinct functional modules: data collection module, extraction module, classification module, and enforcement module. Each module performs a specific task in the malware detection pipeline, allowing for independent optimization and maintenance while improving overall detection efficiency through specialized processing at each stage.
Solution Approach 2:
The patent introduces intermediary components such as the data appliance that acts as a bridge between network traffic and the analysis system, and uses intermediary data structures like feature vectors and confidence scores to facilitate communication between extraction and classification modules. These intermediaries simplify the integration complexity while enabling automated high-speed detection.
2Measurement precision
If heuristic and machine learning classifiers are used, then measurement precision and detection accuracy improve, but computational resource requirements and processing time increase
Solution Approach 1:
The system applies partial action by using ensemble classification where multiple classifiers (heuristic and machine learning) are employed, but each processes only relevant features extracted from malware samples. The classification is performed selectively on suspicious indicators rather than all network traffic, reducing overall computational burden while maintaining high detection accuracy through targeted analysis.
Solution Approach 2:
The system performs preliminary extraction of indicators of compromise (IOCs) and features from malware samples before classification. By pre-processing and organizing data into structured formats with confidence scores, the system reduces the complexity and resource requirements of the subsequent classification stage, enabling accurate detection with optimized computational resource usage.
3Reliability
If comprehensive indicator extraction is performed, then detection reliability improves, but processing time and loss of time increase
Solution Approach 1:
The system implements continuous automated extraction and classification of indicators of compromise from malware samples. The pipeline operates continuously without manual intervention, with data flowing seamlessly through extraction, classification, and enforcement modules. This continuous automated process maintains high detection reliability while reducing processing time by eliminating manual analysis bottlenecks.
Solution Approach 2:
The system performs preliminary extraction of multiple indicator types (IP addresses, domain names, URLs, file hashes) simultaneously during the initial analysis phase. By extracting all relevant indicators upfront and assigning confidence scores, the system enables parallel processing in subsequent classification stages, improving detection reliability through comprehensive indicator analysis while minimizing total processing time through efficient parallelization.
Data Source
AI summary
Techniques for generating actionable indicators of compromise (IOCs) are disclosed. A set of potential sources for IOCs are received. One or more candidate IOCs are extracted from at least one source included in the set of potential sources. An actionable IOC is automatically identified from the one or more candidate IOCs. The actionable IOC is provided to a security enforcement service.