Low-Level Markov Transition Matrices for Disassembled Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware classification methods struggle to identify malware that exists in disassembled code, as they are not scalable and maintain accurate results with an increased number and variety of inputs, particularly when deployed for consumer use.
Innovation Solution
Utilizing Markov transition matrices based on abstract language representations of disassembled code, formed through clustering algorithms, to classify samples as clean or malicious, enabling scalable and accurate malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware classification methods are used, then the system is simple to implement, but it cannot accurately identify malware in disassembled code and is not scalable
Solution Approach 1:
The patent introduces an intermediary abstraction layer that translates disassembled code into a standardized representation format. This intermediary layer enables conventional classification methods to work effectively on malware in disassembled code by converting it into a form that preserves structural characteristics while being compatible with existing classification algorithms, thus improving detection accuracy without requiring complete system redesign
Solution Approach 2:
The patent transforms the input parameters by converting disassembled code into standardized representations that highlight structural features. This parameter transformation allows the classification system to accurately identify malware patterns in disassembled code by changing how the code is represented rather than changing the fundamental classification approach
2Adaptability or versatility
If conventional malware classification methods are used, then the implementation is straightforward, but the system cannot maintain accurate results with increased number and variety of inputs
Solution Approach 1:
The patent creates a universal representation framework that can handle multiple types of inputs including malware in disassembled code, malware in binary format, and malware in source code. This universal framework maintains consistent classification accuracy across diverse input types by translating them into a common representation that preserves essential structural characteristics while enabling uniform processing
3Productivity
If the system is deployed for consumer use with increased variety of inputs, then the coverage is improved, but the conventional methods become less accurate and scalable
Solution Approach 1:
The patent segments the malware analysis process into distinct stages: disassembly, representation transformation, and classification. By segmenting the process, the system can handle diverse inputs at each stage while maintaining accuracy through the standardized representation layer, enabling both high coverage and precision simultaneously
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed to classify a sample as clean or malicious. An example apparatus includes instruction identifies circuitry to convert a sample into a sequence of instructions, abstract language circuitry to transform the sequence of instructions into an abstract language representation, transition matrix circuitry to create a Markov transition matrix, the Markov transition matrix to represent transitions within the abstract language representation, and classifier circuitry to classify an unknown sample as clean or malicious, the classification in response to whether the Markov transition matrix is closer to a clean group of Markov transition matrices or a malicious group of Markov transition matrices.