Malicious File Detection Using Trained Machine Learning Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in detecting malicious files with unique characteristic features different from known files, and they lack effective methods for training and retraining models to adapt to new malicious behaviors.
Innovation Solution
A system and method using a trained machine learning model that forms behavior patterns from executed files, selects multiple detection models based on these patterns, calculates the degree of harmfulness, and recognizes files as malicious if the similarity exceeds a threshold, with the ability to retrain models based on execution data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple detection models are used to detect malicious files with unique features, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The detection system is segmented into multiple specialized detection models, each trained to detect specific types of malicious files with unique characteristic features. This segmentation allows each model to focus on particular patterns, improving overall detection accuracy while maintaining manageable complexity through modular design.
Solution Approach 2:
The system employs multiple detection models that collectively provide universal coverage against various types of malicious files. Each model serves multiple purposes: detecting its specific threat type, contributing to overall system accuracy, and being selectively activated based on file characteristics, thus achieving multi-functionality.
2Adaptability or versatility
If machine learning models are trained and retrained on execution data, then adaptability to new malicious behaviors is improved, but loss of time for training increases
Solution Approach 1:
Detection models are pre-trained on extensive execution data from both safe and malicious files before deployment. This preliminary action establishes a strong baseline capability, allowing the system to quickly adapt to new threats through incremental retraining rather than starting from scratch, thus reducing the time loss for continuous adaptation.
Solution Approach 2:
The system implements feedback mechanisms where detection results and execution data are continuously fed back into the training process. This allows models to be retrained with new information about emerging threats, improving adaptability while optimizing training time by focusing only on relevant updates rather than complete retraining.
3Reliability
If behavior logs are analyzed during file execution, then detection effectiveness is improved, but productivity decreases
Solution Approach 1:
The system applies partial action by analyzing only the most relevant behavior logs and commands during file execution, rather than processing every single operation. This selective analysis maintains high detection effectiveness for malicious files while reducing the overhead that would slow down safe file processing, thus balancing reliability and productivity.
Solution Approach 2:
Behavior log analysis is performed periodically at key execution stages rather than continuously at every single operation. This periodic approach allows the system to capture critical malicious behaviors while minimizing the impact on overall file execution speed, improving the balance between detection effectiveness and processing productivity.
Data Source
AI summary
The present disclosure is directed to a system and method of detecting malicious files by using a trained machine learning model. The system may comprise a hardware processor configured to form at least one behavior pattern, calculate the convolution of all behavior patterns, select from a database of detection models at least two models for detection of malicious files on the basis of the behavior patterns, calculate the degree of harmfulness of a file being executed on the basis of an analysis of the convolution and the at least two models for detection of malicious files, form, on the basis of the degrees of harmfulness, a decision-making pattern, recognize the file being executed as malicious if the degree of similarity between the formulated decision-making pattern and at least one of a predetermined decision-making patterns from a database of decision-making patterns previously formulated on the basis of an analysis of malicious files, exceeds a predetermined threshold value.