Malicious Section Detection in Files via ML Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current machine learning models for malware detection can classify files as malicious or normal with high accuracy but fail to identify specific sections of a file containing malicious code.
Innovation Solution
A training data set is prepared by dividing files into sections and labeling each section as normal or malicious, allowing a machine learning module to be trained to identify malicious sections within unknown files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a machine learning model is trained to classify files as malicious or normal, then the classification accuracy is improved, but the ability to identify specific malicious sections within files deteriorates
Solution Approach 1:
The patent divides files into multiple sections and trains the machine learning model to classify each section independently. This segmentation allows the model to identify not only whether a file is malicious but also which specific sections contain malicious code, thereby resolving the contradiction between overall classification accuracy and localization of malicious content.
Solution Approach 2:
The patent transitions from a single-file classification approach to a multi-section classification approach, adding a spatial dimension to the analysis. By evaluating each section separately and aggregating results, the system provides both overall file classification and detailed section-level identification, simultaneously achieving high accuracy and preserving location information.
2Measurement precision
If files are divided into sections for analysis, then the identification of malicious sections is improved, but the complexity of the detection system increases
Solution Approach 1:
The system segments files into standard sections (such as headers, code segments, data segments) that can be independently analyzed. This segmentation approach balances detailed detection capability with manageable system complexity by using predefined section boundaries rather than requiring complex custom segmentation logic.
Solution Approach 2:
The machine learning model is designed to handle multiple functions: it can classify individual sections, aggregate results to determine overall file classification, and provide detailed location information. This multi-functionality reduces the need for separate specialized systems, thereby managing complexity while achieving section-level detection accuracy.
Data Source
AI summary
A training data set for training a machine learning module is prepared by dividing normal files and malicious files into sections. Each section of a normal file is labeled as normal. Each section of a malicious file is labeled as malicious regardless of whether or not the section is malicious. The sections of the normal files and malicious files are used to train the machine learning module. The trained machine learning module is packaged as a machine learning model, which is provided to an endpoint computer. In the endpoint computer, an unknown file is divided into sections, which are input to the machine learning model to identify a malicious section of the unknown file, if any is present in the unknown file.