Malware Classification Using Trie-Based Opcode Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware classification techniques are computationally expensive and time-consuming due to the large number of different types of malware, requiring exhaustive searches through large datasets of feature sets, which slows down the process of identifying unknown executable files as malware or safe files.
Innovation Solution
The use of a Trie data structure to index operation codes from a training set, allowing only a subset of executable files with matching beginning sequences to be compared, reducing the computational burden and improving accuracy by focusing on features from executables compiled by the same compiler/packer.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If exhaustive comparison is performed against large malware datasets, then classification accuracy is improved, but computational cost and processing time increase significantly
Solution Approach 1:
The patent segments the large malware dataset into multiple subsets organized in a hierarchical structure. Instead of comparing against all malware samples at once, the system divides them into groups based on initial feature comparisons, then performs detailed analysis only on relevant subsets. This segmentation maintains classification accuracy while dramatically reducing the time and computational resources required.
2Measurement precision
If exhaustive comparison is performed against large malware datasets, then classification accuracy is improved, but computational resources and complexity increase
Solution Approach 1:
The system segments the computational task into multiple stages with decreasing complexity. The first stage performs simple feature matching to identify potential matches, the second stage performs more detailed comparison on a reduced subset, and subsequent stages refine the classification. This multi-stage segmentation reduces overall computational complexity while maintaining accuracy.
Solution Approach 2:
The patent introduces intermediate data structures and feature representations that act as mediators between the raw malware samples and the final classification. These intermediate structures organize and pre-process information in a way that reduces the complexity of subsequent comparisons, making the overall system more efficient without sacrificing accuracy.
3Reliability
If feature sets from all executable files are compared, then comprehensive classification is achieved, but the comparison process becomes computationally expensive
Solution Approach 1:
The system extracts and compares only the most relevant features from executable files rather than analyzing all features. By identifying and focusing on key discriminative features that are most indicative of malware behavior, the system achieves reliable classification with significantly reduced computational energy requirements.
Solution Approach 2:
The patent applies partial action by performing comprehensive feature comparison only on a subset of files that pass initial filtering stages. For most files, a lighter-weight classification approach is used, reserving the computationally expensive full feature comparison only for cases where it is truly necessary to achieve reliable classification.
Data Source
AI summary
Devices, methods and instructions encoded on computer readable medium are provided herein for implementation of classification techniques in order to determine if an unknown executable file is malware. In accordance with one example method, an unknown executable file comprising a sequence of operation codes (opcodes) is received. Based on the operation codes of the unknown executable, a subset of executable files in a training set is identified in which each of the files in the subset have the same beginning sequence of operation codes as the unknown executable. After the subset is identified, a feature set extracted from the unknown executable file is compared to one or more feature sets extracted from each of executable files in the identified subset. A determination is made, based on the feature set comparison, whether the unknown executable file is malware.