Malware Detection via Behavioral Event Sequencing and Timing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques, such as signature string scanning, are becoming less effective due to modern malware's targeted and polymorphic nature, making it difficult to develop reliable detection methods.
Innovation Solution
A computer-implemented method and system that constructs a classifier using behavior sequencing and timing information of computer files, monitoring runtime behavior, detecting behavior events, generating feature vectors, and constructing a classifier based on these vectors to accurately classify files as malicious or legitimate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If signature string scanning is used for malware detection, then detection can be performed with simple methods, but detection reliability deteriorates due to polymorphic and targeted malware
Solution Approach 1:
The patent replaces the mechanical signature-matching approach with a machine learning-based behavioral analysis system. Instead of scanning for fixed signature strings, the system monitors runtime behavior events and uses trained classifiers to detect malware based on behavioral patterns, thereby resolving the contradiction between simplicity and reliability.
Solution Approach 2:
The patent changes the detection parameters from static signature strings to dynamic behavioral features including event sequences, timing information, and frequency metrics. This parameter transformation enables the system to detect polymorphic malware that changes its code but maintains characteristic behavioral patterns.
2Reliability
If behavior monitoring is implemented to detect targeted malware, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the malware detection problem into distinct behavioral event categories (file operations, registry operations, process operations, etc.). Each event type is monitored and classified separately, allowing the complex detection task to be broken down into manageable components that can be processed by individual classifier rules.
Solution Approach 2:
The patent introduces trained machine learning classifiers as intermediaries between raw behavior event data and detection decisions. These classifiers act as mediators that process complex behavioral sequences and timing information, translating them into reliable detection outcomes without requiring the end system to directly analyze all raw data.
3Measurement precision
If comprehensive behavior events are monitored, then malware classification accuracy improves, but data processing time increases
Solution Approach 1:
The patent extracts only the most discriminative behavioral features from comprehensive behavior monitoring, including event sequences, timing intervals, and frequency counts. By selecting and extracting only the critical features needed for classification, the system maintains high accuracy while reducing the volume of data requiring processing.
Solution Approach 2:
The patent monitors comprehensive behavior events but processes them selectively using pre-trained classifier rules. The system performs partial processing by applying classification logic only to relevant behavior patterns rather than analyzing every single event in detail, thereby balancing accuracy with processing efficiency.
Data Source
AI summary
A decision tree for classifying computer files is constructed. A set of training files known to be legitimate or malicious are executed and their runtime behaviors are monitored. When a behavior event is detected for one of the training file at a point in time, a feature vector is generated for that training file. Behavior sequencing and timing information for the training file at that point in time is identified and encoded in the feature vector. Feature vectors for each of the training files at various points in time are fed into a decision tree induction algorithm to construct a decision tree that takes into account of the sequencing and timing information.