Malicious Script Detection Using Ensemble Learning Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect file-less malicious scripts, especially those executed in memory using PowerShell, as they leave minimal traces and are difficult to distinguish from benign scripts, and signature-based detection methods are ineffective.
Innovation Solution
An apparatus and method that extract token-type and tree-node-type features from scripts using an abstract syntax tree, train two learning models, and apply ensemble-based detection to differentiate between malicious and normal scripts by setting weights based on similarity comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used, then detection speed is maintained, but detection accuracy deteriorates because file-less malicious scripts leave no traces in the file system
Solution Approach 1:
The patent replaces traditional signature-based detection (mechanical pattern matching) with machine learning-based detection that analyzes script behavior and characteristics. The system uses trained models to identify malicious patterns without relying on pre-defined signatures, enabling detection of file-less scripts that leave no traditional traces.
Solution Approach 2:
The patent changes the detection parameters from file-based signatures to behavioral and structural features of scripts. By analyzing script content, execution patterns, and characteristics in memory, the system detects malicious scripts without requiring them to be saved to disk, thus improving detection accuracy for file-less attacks.
2Adaptability or versatility
If traditional detection methods are used, then simplicity is maintained, but detection capability deteriorates against new variants of malicious scripts
Solution Approach 1:
The patent performs preliminary training of machine learning models using datasets of known malicious and benign scripts. This pre-training enables the system to rapidly detect new variants without requiring time-consuming analysis or updates, as the models have already learned to identify malicious patterns and behaviors.
Solution Approach 2:
The system uses multiple detection parameters including script content analysis, execution behavior, and structural features. By changing from single-parameter signature matching to multi-parameter machine learning analysis, the system achieves better adaptability to new variants while maintaining efficient detection speeds through optimized model inference.
3Measurement precision
If ensemble-based detection with multiple learning models is used, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent divides the detection task into multiple specialized learning models, each trained to detect specific types of malicious scripts or patterns. This segmentation allows the system to use appropriate models for different threats, improving overall accuracy while managing computational resources efficiently through selective model deployment.
Solution Approach 2:
The patent combines multiple learning models into an ensemble detection system that aggregates their results. By merging the strengths of different models (e.g., some specialized in PowerShell scripts, others in general malicious patterns), the system achieves superior detection accuracy while distributing computational load across multiple optimized models.
Data Source
AI summary
Disclosed herein are an apparatus and method for detecting a malicious script. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program is configured to extract token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, to train two learning models to respectively learn two pieces of learning data that are generated in consideration of features extracted respectively from the token-type features and the node-type features as having the highest frequency, and to detect whether the script is a malicious script based on the result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models.