Malware Classification via Behavior-Based Rule Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware classification techniques face challenges in accurately classifying malware due to variations in malware samples and the presence of 'white noise,' leading to high false positives, which affects system reliability and detection speed.
Innovation Solution
A rule-based behavior analysis system that processes input data to identify salient behaviors, applies pre-defined rules to these behaviors, and generates a rule aggregation sequence to classify malware, with the removal of 'white noise' rules enhancing accuracy, using a threat detection system that includes monitoring logic within software components and a sandboxed environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional classification techniques are used to handle malware variants, then malware classification is attempted, but false positives increase due to high variability in malware samples and presence of white noise
Solution Approach 1:
The patent segments malware classification into distinct phases: behavior monitoring, rule triggering, sequence generation, and classification. By dividing the classification process into discrete rule sequences that can be independently evaluated, the system handles malware variants more effectively without being overwhelmed by sample variability.
Solution Approach 2:
The patent extracts and removes 'white noise' rules from the rule aggregation sequence before classification. This extraction of irrelevant or non-discriminative rules reduces false positives and improves classification reliability by focusing only on salient behavioral patterns.
2Measurement precision
If all behaviors are monitored and analyzed for classification, then comprehensive analysis is achieved, but processing time increases and detection speed decreases
Solution Approach 1:
The patent extracts only the salient behaviors that trigger predefined rules, rather than analyzing all monitored behaviors. This selective extraction of relevant behavioral patterns maintains classification comprehensiveness while significantly reducing processing time and improving detection speed.
Solution Approach 2:
The patent applies partial action by focusing analysis only on behaviors that match predefined rules, rather than exhaustively analyzing all behaviors. This partial analysis approach achieves sufficient classification accuracy without the computational overhead of complete behavior analysis.
3Reliability
If pre-defined rules are applied to all monitored behaviors, then thorough rule evaluation is performed, but processing complexity and time consumption increase
Solution Approach 1:
The patent performs preliminary action by pre-defining rules and their sequences before malware analysis. This advance preparation allows the system to quickly match observed behaviors against predetermined patterns without performing complex real-time rule generation, thereby maintaining thoroughness while reducing processing time.
Solution Approach 2:
The patent segments the rule evaluation process into discrete, ordered sequences where rules are evaluated in a predetermined sequence. This segmentation allows the system to stop evaluation early when sufficient evidence is found, maintaining thoroughness while reducing average processing time.
Data Source
AI summary
According to one embodiment, a malware classification scheme operating with an electronic device, configured with one or more hardware processors and a memory that stores the software handling the malware classification scheme that is conducted through analysis of behavior-based rules, is described. This malware classification scheme (i) conducts a determination whether a sequence of rules correspond to potential malicious behaviors detected during analysis of a malware sample within one or more virtual machines, and in response to determining that the sequence of rules corresponds to potential malicious behaviors, (ii) conducts an attempt to classify the malware sample to at least one known malware family based on an analysis of the sequence of rules.