Malware Detection via Bi-directional LSTM Domain Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise computer systems often go undetectedly infected with malware, leading to intellectual property loss, productivity downtime, and revenue loss due to the inability to promptly identify and prevent malicious domain name communications.
Innovation Solution
A system utilizing machine learning algorithms to continuously monitor domain name logs for malware-related domain names, employing a trio of machine learning models (bi-directional LSTM RNNs) to classify and predict domain legitimacy, thereby proactively alerting operators to potential malware threats and minimizing downtime and financial loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then the system structure is simple, but malware detection accuracy is low and infections go unnoticed until damage occurs
Solution Approach 1:
The malware detection system is segmented into multiple specialized machine learning models: a bi-directional LSTM RNN for temporal sequence analysis of domain names, a classification model for identifying malicious patterns, and a prediction model for future threat assessment. Each model processes specific aspects of malware detection, improving overall accuracy while maintaining modular complexity management.
Solution Approach 2:
The patent introduces machine learning models as intermediary components between raw domain name data and malware detection decisions. These models act as mediators that transform and analyze domain name sequences, extracting meaningful patterns that traditional methods miss, thereby enhancing detection accuracy without requiring direct complex rule-based systems.
2Loss of time
If real-time malware monitoring is implemented, then response time is reduced, but computational resources and system complexity increase
Solution Approach 1:
The system performs preliminary actions by continuously training and updating machine learning models with historical malware data before actual malware detection is needed. The bi-directional LSTM RNN pre-processes and analyzes domain name sequences in advance, building predictive capabilities that enable rapid real-time detection without excessive computational burden during critical response phases.
Solution Approach 2:
The patent implements continuous monitoring and analysis of domain name logs through the machine learning models, maintaining constant readiness for malware detection. The system continuously processes incoming domain data through the trained models, ensuring uninterrupted surveillance that reduces response time while optimizing resource utilization through efficient model inference.
3Measurement precision
If machine learning models are used to classify domain names, then malware detection accuracy is improved, but processing time and computational complexity increase
Solution Approach 1:
The patent employs a dynamic bi-directional LSTM RNN architecture that adapts its processing based on the characteristics of domain name sequences. The model dynamically adjusts its analysis depth and computational resources allocated to different domain patterns, maintaining high classification accuracy while optimizing processing speed for varying input complexities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system for detecting and preventing execution of malware on a target system includes an interface for receiving training data. The training data includes domain names known to be legitimate and domain names known to be associated with malware. The system is configured to train a first model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names using a supervised learning methodology. The system configured to train a second model to predict a correct domain name associated with domain names in the training data using an unsupervised learning methodology. The system configured to train a third model to classify the domain names in the training data as being legitimate domain names or malware-associated domain names based on an output of the first learning model and an output of the second learning model.