Machine Learning Malware Detection via Incremental Packet Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems take a significant amount of time to determine whether a file is malicious or benign, often requiring 15 minutes or more, which can allow malware to cause damage or steal information before detection.
Innovation Solution
A machine learning-based malware detection engine that determines the probability of maliciousness by incrementally inspecting one or more packets associated with a file, allowing for rapid evaluation of file maliciousness, potentially in under 10 milliseconds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complete file analysis is performed using traditional malware detection engines, then detection accuracy is improved, but detection time increases to 15 minutes or more
Solution Approach 1:
The patent segments the file analysis process by inspecting packets incrementally as they arrive rather than waiting for the complete file. The malware detection engine processes each packet independently and updates the maliciousness probability in real-time, allowing detection to occur on partial data rather than requiring the entire file.
Solution Approach 2:
The system performs preliminary malware detection actions on incoming packets before the complete file is available. By computing maliciousness probability on partial packet data and making preliminary assessments, the system can detect malware early in the transfer process rather than after complete file reception.
2Reliability
If malware sandbox is used to execute and monitor file behavior, then detection efficacy is improved, but processing time increases to minutes or hours
Solution Approach 1:
The patent applies partial action by using only the portion of data needed for effective detection - specifically, inspecting packet headers and initial packet contents rather than executing the complete file in a sandbox. This partial inspection approach achieves sufficient detection efficacy without the time cost of full sandbox execution.
Solution Approach 2:
The system extracts key features and characteristics from packet headers and initial packet data that are indicative of malware behavior, without needing to execute the complete file. By taking out and analyzing only the critical identifying features from partial data, the system achieves rapid detection.
3Reliability
If traditional signature-based detection is used, then known malware can be detected, but detection rate is limited to approximately 42%
Solution Approach 1:
The patent changes the detection parameters from fixed signature matching to dynamic probability assessment. Instead of relying solely on predetermined malware signatures, the system computes a maliciousness probability based on multiple packet features and updates this probability as more packets are received, enabling detection of both known and unknown malware variants.
Solution Approach 2:
The detection system transitions from static signature matching to dynamic probability-based detection. The maliciousness probability is continuously updated as packets are received and analyzed, allowing the system to adapt to varying malware patterns and improve detection coverage beyond traditional signature-based approaches.
Data Source
AI summary
The methods described herein include receiving a plurality of packets associated with a file, each of the plurality of packets comprising content, and a source domain; extracting one or more features from content of a first packet of the plurality of packets; applying a trained machine learning model to the extracted one or more features to determine a probability of maliciousness associated with the first packet; responsive to determining that the probability maliciousness of the first packet is between a first threshold value and a second threshold value, labeling the first packet as having an uncertain maliciousness; extracting one or more features from content of a second packet of the plurality of packets; and applying the trained machine learning model to the extracted one or more features of the first packet and the second packet to determine a probability of maliciousness associated with the second packet.