Cross-Product Malware Categorization via Matrix Factorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in cross-product categorization due to differences in signatures and family grouping criteria, leading to inconsistent classification of malicious files across different products.
Innovation Solution
A computer-implemented method for cross-product malware categorization that accesses incomplete feature and label datasets, determines correlations between features and labels, and constructs complete datasets using low-rank matrix factorization and discriminative constraints to derive a labeling model for predicting malware files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If different malware detection products use different signatures and family grouping criteria, then each product can detect malware according to its own methodology, but cross-product categorization consistency deteriorates
Solution Approach 1:
The patent introduces an intermediary mapping model that translates between different malware family classification systems. This mediator learns the correlation between features from multiple detection products and their corresponding malware labels, enabling consistent cross-product categorization while preserving each product's detection methodology diversity
Solution Approach 2:
The patent transforms the classification problem by changing parameters from direct family labeling to learned feature correlations. By using matrix factorization and discriminative constraints, the system transforms incomplete feature and label datasets into a unified representation space that maintains consistency across different detection products
2Measurement precision
If complete malware labeling is performed for all files, then categorization accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by working with incomplete feature and label datasets rather than requiring complete labeling of all files. The matrix factorization approach can handle missing entries and derive accurate categorizations from partial data, reducing processing time while maintaining accuracy
Solution Approach 2:
The patent performs preliminary action by pre-learning the correlation between features and malware labels from available datasets. This pre-trained mapping model can then quickly categorize new malware files without requiring complete re-labeling, significantly reducing processing time for future classifications
3Measurement precision
If more features are extracted from malware binaries, then classification accuracy improves, but data completeness and processing complexity worsen
Solution Approach 1:
The patent extracts and focuses on the most discriminative features through matrix factorization. By decomposing the feature matrices and identifying correlated features with malware labels, the system extracts only the essential features needed for accurate classification, reducing processing complexity while maintaining accuracy
Solution Approach 2:
The patent creates a universal mapping model that can handle multiple feature types (n-grams, call graphs, API sequences) and different malware detection products simultaneously. This multi-functional approach simplifies data processing by providing a unified framework that works across diverse feature sets without requiring separate processing pipelines
Data Source
AI summary
The disclosed computer-implemented method for cross-product malware categorization may include accessing computer readable media storing an incomplete feature dataset and an incomplete label dataset, determining a correlation between the plurality of features and the plurality of malware labels, and constructing at least one of a complete feature dataset based on the incomplete feature dataset and the correlation and a complete label dataset based on the incomplete label dataset and the correlation. Various other methods, systems, and computer-readable media are also disclosed.