Localized Machine Learning for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional machine learning models trained on global datasets may not be effective in detecting malware in diverse client device environments, leading to inefficiencies in malware detection and increased false positive rates.
Innovation Solution
The use of localized machine learning models, generated by re-training global models with local datasets, to detect malware on individual devices, which reduces false positive rates and enhances detection efficiency by considering environment-specific file types and malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a global machine learning model trained on a global dataset is used for malware detection, then the model can be deployed across multiple computing devices, but the detection accuracy decreases in diverse client device environments
Solution Approach 1:
The patent segments the single global machine learning model into multiple environment-specific models. Each computing device trains its own localized model using its specific computing environment data, dividing the universal detection task into specialized sub-tasks that adapt to local conditions while maintaining the overall security framework.
Solution Approach 2:
The patent implements local quality by training customized machine learning models for each computing device based on its specific computing environment. Each device's model is optimized for its local characteristics (file types, malware patterns, usage patterns), ensuring high detection accuracy tailored to local needs rather than using a one-size-fits-all global model.
2Device complexity
If a global machine learning model is used for malware detection, then the system complexity is reduced, but the false positive rate increases
Solution Approach 1:
The patent reduces false positives by segmenting the detection system into localized models that understand local file patterns and malware characteristics. Each device's model is trained on its specific data, reducing misclassification of local benign files as malware, thereby lowering false positive rates while maintaining manageable system complexity through automated local training.
3Measurement precision
If localized machine learning models are generated by re-training global models with local datasets, then detection accuracy is improved, but the computational resources and time required increase
Solution Approach 1:
The patent applies preliminary action by pre-training a global machine learning model on comprehensive global malware data before deploying it to individual devices. This pre-trained global model serves as a strong foundation that already understands general malware patterns, reducing the amount of additional local training needed and thereby decreasing the time and computational resources required for localized adaptation.
Solution Approach 2:
The patent enables continuous improvement of detection accuracy by allowing devices to continuously train and update their localized models using new computing environment data. This continuous learning process maintains high detection accuracy over time as malware evolves and local patterns change, without requiring complete retraining from scratch.
Data Source
AI summary
The disclosed computer-implemented method for malware detection using localized machine learning may include (i) generating a global score for a file using a global machine learning model, (ii) generating a localized score for the file using a localized machine learning model, (iii) determining that the file is malware using the global score, the localized score, and the local conviction threshold, and (iv) in response to determining that the file is malware, performing a security action to protect the computing device against malware. Various other methods, systems, and computer-readable media are also disclosed.