Malicious Code Rule Inference via Word2vec Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Android platform faces significant security risks due to a high number of malicious software packages, with existing detection methods being inefficient in identifying unknown malicious samples, leading to a need for improved malicious code rule inference to optimize virus detection engines with low false alarm rates and high coverage rates.
Innovation Solution
A deep learning method is employed to infer malicious code rules by parsing dex files, extracting key character strings, training them using the word2vec principle, constructing feature vectors, and acquiring character string rules, which enhances the efficiency of malicious code detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing virus detection engines are used to filter known rules and samples, then detection of known malicious samples is reliable, but detection efficiency decreases for unknown malicious samples requiring machine learning or manual analysis
Solution Approach 1:
The patent applies preliminary action by pre-training word2vec models on malicious code character strings before actual detection. This pre-processing step creates optimized feature representations that enable faster and more accurate detection of both known and unknown malicious samples, reducing the need for time-consuming manual analysis while maintaining high reliability
Solution Approach 2:
The patent introduces character string feature vectors as an intermediary between the raw malicious code and the detection engine. These feature vectors serve as a bridge that transforms complex code into structured representations, enabling the detection engine to efficiently process both known rules and unknown samples with improved accuracy and speed
2Productivity
If malicious code rules are extracted to optimize the detection engine, then detection efficiency increases, but false alarm rate may increase if rules are too wide
Solution Approach 1:
The patent applies local quality by extracting specific characteristic features from malicious code character strings rather than using broad general rules. The word2vec model identifies and emphasizes locally distinctive patterns in the code, enabling the detection engine to target specific malicious behaviors with high precision, thereby improving detection efficiency while minimizing false alarms through localized feature matching
Solution Approach 2:
The patent changes parameters by transforming raw character strings into optimized feature vectors through word2vec training. This parameter transformation process converts discrete code characters into continuous vector representations with optimized dimensions, allowing the detection engine to operate with refined parameters that improve both detection efficiency and precision while reducing false alarm rates
3Productivity
If malicious code rules are extracted to optimize the detection engine, then detection efficiency increases, but coverage rate may decrease if rules are too specific
Solution Approach 1:
The patent applies universality by training the word2vec model on diverse malicious code samples to create feature vectors that capture universal patterns across different types of malware. The resulting detection engine can efficiently process various malicious code variants through these generalized features, maintaining high detection efficiency while achieving broad coverage across different malware families and attack vectors
Data Source
AI summary
A method, a system and a terminal device for inferring a malicious code rule based on a deep learning method. The method comprises: performing twice training on a known malicious code character string by utilizing a deep learning method based on a word2vec thought, thus obtaining a character string having maximum correlation with the malicious code character string, and further obtaining a character string rule of a malicious code. The method infers a malicious code rule having a low false alarm rate and a high coverage rate by fully utilizing the feature of a malicious sample, thereby optimizing an existing virus detection engine, and increasing detection efficiency of a malicious code.