Malware Classification Using Decision Tree Leaf Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware classification systems face challenges in accurately identifying new malware, often relying on databases of known files, performing computationally costly analyses, and losing accuracy when subclassifying unknown files, leading to inefficiencies and user frustration.
Innovation Solution
A computer-implemented method using a machine-learning heuristic that employs a decision tree to classify files as malicious, followed by sub-classification based on leaf nodes associated with specific types of malware, reducing the need for additional decision trees and improving precision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional systems perform lengthy and computationally costly analyses on potentially malicious files, then classification accuracy may be maintained, but system performance deteriorates and user experience worsens
Solution Approach 1:
The patent segments the malware classification task into two distinct phases: (1) a quick initial classification using a lightweight machine-learning heuristic to determine if a file is malicious, and (2) a more detailed sub-classification phase that only processes files already identified as malicious. This segmentation allows the system to avoid computationally expensive analyses on benign files while maintaining accurate classification for malicious ones.
Solution Approach 2:
The patent applies partial action by performing only the necessary level of analysis for each file. The lightweight heuristic performs partial classification (malicious vs. benign), and only files requiring further scrutiny undergo the more comprehensive sub-classification process. This avoids excessive computation on files that don't require it.
2Productivity
If traditional systems use databases of known malware files for classification, then speed may be improved, but accuracy deteriorates for new malware not in the database
Solution Approach 1:
The patent employs preliminary action by pre-training the machine-learning heuristic on a comprehensive dataset of malware characteristics during the offline phase. This preliminary training enables the system to quickly recognize patterns in new malware during online classification without requiring exhaustive database lookups, thus maintaining both speed and accuracy for novel threats.
Solution Approach 2:
The patent changes the classification parameters by transitioning from exact database matching (string comparison of file hashes) to pattern-based classification using machine-learning heuristics. This parameter change allows the system to generalize from known malware patterns to identify new malware variants that share similar characteristics, improving accuracy for unknown threats while maintaining fast classification.
3Loss of information
If traditional systems attempt to sub-classify unknown files, then detailed classification may be achieved, but accuracy is lost due to premature classification attempts
Solution Approach 1:
The patent segments the classification process into hierarchical levels: first determining whether a file is malicious (binary classification), then separately performing sub-classification only on confirmed malicious files. This segmentation prevents premature sub-classification attempts on benign files, preserving accuracy by ensuring that detailed classification is only applied when appropriate.
Solution Approach 2:
The patent performs preliminary classification to establish the malicious nature of a file before attempting sub-classification. This preliminary action ensures that the file is indeed malicious and requires further classification, preventing loss of information and maintaining precision by avoiding unnecessary or misleading sub-classification of benign files.
Data Source
AI summary
The disclosed computer-implemented method for classifying files as specific types of malware may include (i) identifying an unknown file on a computing device, (ii) performing an analysis of the unknown file by applying, to the unknown file, a machine-learning heuristic that employs at least one decision tree, (iii) classifying the unknown file as malicious based on the analysis, and (iv) after classifying the unknown file as malicious, using the same decision tree employed by the machine-learning heuristic to sub-classify the unknown file by (a) identifying at least one leaf node of the decision tree arrived at by the analysis performed by the machine-learning heuristic on the unknown file, (b) determining that the leaf node of the decision tree is associated with a particular type of malicious file, and (c) sub-classifying the unknown file as the particular type of malicious file. Various other methods, systems, and computer-readable media are also disclosed.