Malicious Executable Classification System Using Byte N-grams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in detecting unknown malicious executable software code, particularly due to the ease of writing polymorphic viruses and the limitations of signature-based detection methods, which require obtaining copies of malicious programs to create detection patterns, and are not effective for unknown or obfuscated code.
Innovation Solution
A Malicious Executable Classification System (MECS) using machine learning and data mining techniques, specifically extracting byte sequences into n-grams and constructing classifiers like IBk, TFIDF, naive Bayes, support vector machines, and decision trees, to detect malicious executables without removing obfuscation, with boosted decision trees achieving high performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to detect malicious executables, then detection accuracy for known viruses is improved, but the system cannot detect unknown or polymorphic malicious code
Solution Approach 1:
The patent transforms the detection approach by changing the parameters used for analysis. Instead of relying on fixed signature patterns, the system extracts multiple features from executable files including byte sequences, import tables, export tables, and section headers. These features are then used to train machine learning classifiers that can adapt to detect both known and unknown malicious code by learning from the statistical properties of the code rather than matching predefined patterns.
2Adaptability or versatility
If machine learning methods are applied to detect malicious code, then the ability to detect unknown executables is improved, but the system complexity increases
Solution Approach 1:
The patent segments the malicious code detection problem into multiple independent feature extraction tasks. The system divides the analysis into distinct components: extracting byte sequences, analyzing import tables, examining export tables, and parsing section headers. Each feature is extracted and processed separately, then combined for classification. This segmentation reduces the overall complexity by breaking down the complex machine learning task into manageable, modular steps that can be implemented and maintained independently.
3Reliability
If feature extraction from executable files is performed to improve detection capability, then the detection robustness against obfuscation is improved, but the processing time and computational resources increase
Solution Approach 1:
The patent implements a two-stage detection process that applies partial action. In the first stage, the system extracts and analyzes key features from executable files to identify potential threats. In the second stage, machine learning classifiers are applied only to files that show suspicious characteristics in the first stage. This approach provides robust detection against obfuscation by analyzing multiple features, while reducing processing time by avoiding full analysis of all files, thus balancing reliability and efficiency.
Data Source
AI summary
A system and method for detecting malicious executable software code. Benign and malicious executables are gathered; and each are encoded as a training example using n-grams of byte codes as features. After selecting the most relevant n-grams for prediction, a plurality of inductive methods, including naive Bayes, decision trees, support vector machines, and boosting, are evaluated.