Malicious File Detection Using Flow Graph Classifier Ensembles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious files in non-isolated environments are limited by the evolving nature of malware, making it difficult to accurately identify and block such files before they launch, particularly in systems where isolation is not feasible.
Innovation Solution
A computer-implementable method and system that utilizes statistical analysis of both binary and disassembled executable files, incorporating control flow and data flow graphs, along with a classifier ensemble to improve detection accuracy by extracting various parameters and constructing feature vectors, which are then used to train classifiers with predefined priorities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then detection capability exists, but accuracy deteriorates due to evolving malware that reduces likelihood of detection
Solution Approach 1:
The patent transforms the detection approach by changing parameters from traditional signature-based methods to a multi-dimensional parameter space including control flow graph metrics, data flow graph metrics, and statistical features. This parameter transformation enables detection of malware that has evolved to evade traditional detection methods by analyzing structural and behavioral characteristics rather than known signatures.
Solution Approach 2:
The detection system combines multiple classification algorithms (Random Forest, SVM, Neural Network, Gradient Boosting) into a composite ensemble model. Each classifier processes different aspects of the extracted features, and their combined output achieves higher detection accuracy and reliability than any individual classifier, addressing the problem of evolving malware that can bypass single-method detection.
2Measurement precision
If comprehensive analysis of executable files is performed, then detection accuracy improves, but memory consumption increases
Solution Approach 1:
The patent extracts only the most discriminative features from executable files, including control flow graph metrics (number of nodes, edges, cycles), data flow graph metrics, and statistical features. By selecting and extracting only the essential parameters needed for detection rather than analyzing all possible file attributes, the system achieves high detection accuracy while maintaining reasonable memory consumption.
Solution Approach 2:
The analysis process is segmented into distinct stages: control flow graph extraction, data flow graph extraction, feature computation, and classification. Each stage processes specific aspects of the executable file independently, allowing efficient memory management where intermediate results are computed and stored only when needed, rather than loading entire files into memory simultaneously.
3Measurement precision
If statistical analysis with large data extraction is used, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The patent performs preliminary actions by pre-computing control flow graphs and data flow graphs from executable files before the actual classification process. These graphs are constructed once and their metrics (number of nodes, edges, cycles, paths) are extracted and stored as features. This preliminary processing separates the complex graph analysis from the classification stage, reducing computational complexity during runtime while maintaining high detection accuracy through comprehensive feature extraction.
Solution Approach 2:
The patent introduces intermediate representations (control flow graphs and data flow graphs) that serve as mediators between the raw executable file and the classification algorithms. These intermediate structures organize the complex information in a structured format, making it easier for classifiers to process. The graphs act as intermediaries that transform the binary executable into a form that preserves malicious patterns while being computationally tractable for analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This technical solution relates to a computer field, in particular, to a method and a system for detecting malicious files in non-isolated environment. The computer-implementable method for detecting malicious files in non-isolated environment the method comprises: preparatory step, wherein creating a collection of files, the collection of files comprises at least one of malicious executable files and at least one of non-malicious executable files; analyzing at least one executable file, wherein: extracting data from both binary and disassembled forms of the executable file, creating parameters, based on said extracted data, for further classifier training, and determining the parameters specific to malicious files and/or vice versa to non-malicious files by a statistical method; wherein additionally extracting the first and the second flow graph; constructing the first and the second feature vector based on the created parameters; creating an ensemble of classifiers from: the first trained classifier based on the first feature vector, the second trained classifier based on the second feature vector; the third classifier trained on the basis of the first flow graph, the fourth classifier trained on the basis of the second flow graph; wherein predefining a decisive priority for each classifier; and operating step, wherein: obtaining at least one executable file; starting the ensemble of classifiers trained at the preparatory step for detection of malicious executable files; outputting the analysis result.