Multi-Format Malicious File Detection Using String-Length Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning tools are limited in their ability to detect malicious files across multiple file formats, requiring multiple models and significant resources for different file types and formats.
Innovation Solution
A single machine learning model is used to detect malicious files across various file types and formats by extracting feature vectors based on string lengths and applying them to a common model, utilizing feed-forward deep neural networks and gradient boosted decision ensembles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple machine learning models are used to detect malicious files across different file formats, then detection coverage is improved, but device complexity and resource consumption increase
Solution Approach 1:
The patent applies universality by designing a single machine learning model that can process multiple file formats (OLE2, XML, PDF, etc.) through a unified feature extraction approach. The model uses string length-based features that are format-agnostic, allowing one model to perform the function of multiple specialized models, thereby reducing device complexity while maintaining detection coverage
Solution Approach 2:
The patent changes the parameter representation from format-specific features to universal string length parameters. By extracting strings delimited by common delimiters (space, tab, newline, slash) and using their lengths as features, the system transforms diverse file formats into a common parameter space that a single model can effectively process
2Measurement precision
If multiple machine learning models are used for different file formats, then detection accuracy is improved, but resource consumption increases
Solution Approach 1:
The patent merges multiple detection models into a single unified model that processes all file formats. By combining the detection functionality into one model and using unified string length-based features, the system reduces computational overhead and resource consumption while maintaining detection accuracy through the universal applicability of the feature extraction method
3Measurement precision
If format-specific detection methods are used, then detection precision for that format is improved, but adaptability to other formats deteriorates
Solution Approach 1:
The patent extracts the essential detection features from various file formats by focusing on string lengths rather than format-specific structures. By taking out the common element (string length) that exists across all formats and using it as the basis for detection, the system achieves both format-specific precision and multi-format adaptability simultaneously
Data Source
AI summary
An apparatus for detecting malicious files includes a memory and a processor communicatively coupled to the memory. The processor receives multiple potentially malicious files. A first potentially malicious file has a first file format, and a second potentially malicious file has a second file format different than the first file format. The processor extracts a first set of strings from the first potentially malicious file, and extracts a second set of strings from the second potentially malicious file. First and second feature vectors are defined based on lengths of each string from the associated set of strings. The processor provides the first feature vector as an input to a machine learning model to produce a maliciousness classification of the first potentially malicious file, and provides the second feature vector as an input to the machine learning model to produce a maliciousness classification of the second potentially malicious file.