Iterative Clustering for Malware Variant Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern malware variants often evade detection due to polymorphisms and targeted delivery, making it difficult for security software to recognize and classify them effectively, as they may appear as different instances rather than related variants within a malware family.
Innovation Solution
A method involving iterative clustering of labeled and unlabeled samples based on feature similarity, recursively selecting subsets of features to propagate labels from known malware samples to unknown ones, revealing hierarchical relationships and classifying previously unlabeled samples within malware families.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software uses traditional detection methods, then it can identify known malware variants, but it fails to detect polymorphic malware and targeted delivery variants
Solution Approach 1:
The patent segments the malware detection problem into two parts: using a small set of labeled samples (known malware and benign files) to train a clustering model, then applying this model to classify large numbers of unlabeled samples. This segmentation allows the system to learn from limited labeled data while scaling to handle diverse unlabeled malware variants effectively.
Solution Approach 2:
The clustering algorithm performs self-service by automatically discovering patterns and relationships in the data without requiring manual programming of detection rules. The system self-adjusts to identify malware families and variants through iterative clustering, enabling it to adapt to new polymorphic malware without human intervention or pre-configured signatures.
2Measurement precision
If security software is configured to recognize specific malware instances, then it can detect known variants, but it cannot recognize polymorphic variants that vary over time
Solution Approach 1:
The patent applies dynamics by using an iterative clustering process that dynamically adapts to the data. The algorithm repeatedly clusters samples, selects representative features, and refines clusters until convergence. This dynamic process enables the system to automatically adjust to polymorphic variants and identify their underlying family relationships, maintaining high detection accuracy across varying malware instances.
Solution Approach 2:
The system changes parameters by selecting different subsets of features at different stages of the clustering process. Initially, it uses a broad set of features to create coarse clusters, then progressively refines by selecting more specific features. This parameter change strategy allows the system to handle both known malware with high precision and polymorphic variants with adaptability.
3Productivity
If security software analyzes all malware features, then it can identify specific variants, but the complexity increases due to polymorphisms and targeted delivery
Solution Approach 1:
The patent extracts only the most relevant features by using iterative clustering to identify and select representative features from the full feature set. At each iteration, the algorithm extracts features that best distinguish clusters, effectively filtering out redundant or less informative features. This extraction reduces the complexity of analysis while maintaining high classification accuracy and productivity.
Solution Approach 2:
The system applies partial action by analyzing only the necessary subset of features at each clustering iteration rather than processing all possible features simultaneously. This partial analysis approach reduces computational complexity while still achieving accurate malware classification, as the iterative process progressively refines the feature subset to what is actually needed for effective differentiation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An unlabeled sample is classified using clustering. A set of samples containing labeled and unlabeled samples is established. Values of features are gathered from the samples contained in the datasets and a subset of features are selected. The labeled and unlabeled samples are clustered together based on similarity of the gathered values for the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples. The selecting and clustering steps are recursively iterated on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached. The iterations produce a cluster having a labeled sample and an unlabeled sample. A label is propagated from the labeled sample in the cluster to the unlabeled sample in the cluster to classify the unlabeled sample.