Multi-Level Malware Classification Using VPT Hashing and ML

The patent segments the malware detection process into multiple levels: first using traditional hashing for quick rejection of obviously benign files, then applying vantage-point tree based locality-sensitive hashing for intermediate filtering, and finally using machine learning models for comprehensive analysis of suspicious files. This multi-level segmentation allows the system to maintain high detection rates while managing computational complexity efficiently.

The patent implements a dynamic detection system that adapts its analysis depth based on the suspiciousness score of each file. Files are initially assessed using lightweight hashing, and only those exceeding certain thresholds proceed to more complex vantage-point tree analysis and machine learning evaluation. This dynamic approach optimizes resource utilization while maintaining detection effectiveness.

The patent applies preliminary filtering using traditional hashing algorithms before invoking the computationally intensive vantage-point tree structure. By pre-identifying and eliminating obviously benign files through simple hash comparison, the system reduces the number of files that require expensive VPT analysis, thereby lowering overall computational intensity while maintaining detection rate.

The patent applies different detection methods with varying computational costs to different subsets of files based on their characteristics. Benign-looking files receive minimal processing with simple hashing, while suspicious files undergo comprehensive VPT and machine learning analysis. This local differentiation of processing quality optimizes energy usage by concentrating computational resources where they are most needed.

The patent segments the file population into different risk categories using a multi-stage filtering process. Only files that pass through initial hashing filters and vantage-point tree evaluation with suspiciousness scores above certain thresholds are subjected to comprehensive machine learning assessment. This segmentation ensures that ML resources are concentrated on high-risk files, maintaining detection rate while preserving processing speed for the overall file population.

The patent applies partial machine learning assessment rather than comprehensive analysis to all files. By using lightweight hashing and vantage-point tree methods to handle the majority of files, and reserving full ML power only for suspicious cases, the system achieves sufficient detection capability without the prohibitive computational cost of universal ML analysis.