Local Computational Models for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in accurately identifying newly discovered malware variants and reducing false positives and false negatives, as adversaries employ obfuscation techniques to evade detection, making it difficult to determine if a program is malware and what harmful actions it performs without running it.
Innovation Solution
The development of computational models that can classify files as malware or benign, using a combination of broad and local models to analyze data streams, where local models are used to prevent false misses and update models efficiently, allowing for faster adaptation to new malware samples without rebuilding the entire model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a broad computational model is used to detect malware, then detection coverage is improved, but model update time and computational resources increase
Solution Approach 1:
The patent divides the broad computational model into a broad model component and multiple local model components. Each local model is trained on specific malware families or types, allowing the system to maintain comprehensive detection coverage through the broad model while using specialized local models for efficient detection of specific threat categories. This segmentation enables selective updating of only relevant local models rather than retraining the entire broad model.
Solution Approach 2:
The system performs partial action by updating only the necessary local model components when new malware samples are detected, rather than retraining the entire broad computational model. This partial updating approach significantly reduces model update time and computational resource requirements while maintaining detection effectiveness through the coordinated operation of broad and local models.
2Adaptability or versatility
If obfuscation techniques are used by adversaries, then malware evasion capability is improved, but detection accuracy deteriorates
Solution Approach 1:
The patent implements local quality by training different local models on specific malware families or types with distinct characteristics. Each local model develops specialized detection capabilities tailored to the particular obfuscation techniques and behavioral patterns of its target malware category. This specialization allows the system to maintain high detection accuracy for specific malware types even when they employ obfuscation, while the broad model provides overall coverage.
3Measurement precision
If local models are used to prevent false misses, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the detection task into a broad model for general coverage and multiple local models for specialized detection. This segmentation manages complexity by organizing models into hierarchical layers with clear division of labor, where the broad model handles general malware detection and local models focus on specific malware families, reducing the complexity burden on any single component.
Solution Approach 2:
The broad computational model serves as a universal component that provides general malware detection coverage across multiple malware families and types. This multi-functional broad model works in coordination with specialized local models, allowing the system to achieve high detection accuracy without each component needing to be overly complex. The broad model's universality compensates for the added complexity of maintaining multiple local models.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example techniques herein determine that a trial data stream is associated with malware ("dirty") using a local computational model (CM). The data stream can be represented by a feature vector. A control unit can receive a first, dirty feature vector (e.g., a false miss) and determine the local CM based on the first feature vector. The control unit can receive a trial feature vector representing the trial data stream. The control unit can determine that the trial data stream is dirty if a broad CM or the local CM determines that the trial feature vector is dirty. In some examples, the local CM can define a dirty region in a feature space. The control unit can determine the local CM based on the first feature vector and other clean or dirty feature vectors, e.g., a clean feature vector nearest to the first feature vector.