Malware Detection via Contextual Convictions and ML

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing malware detection methods are reactive and prone to false positives, as they rely on specific signatures that can change with superficial modifications, and require manual intervention, making them ineffective against frequent innocuous changes to malicious software.

Innovation Solution

A system that uses contextual information and machine learning to determine the maliciousness of software applications, combining traditional fingerprints, generic signatures, and contextual data such as recent infections and geographic location, to provide a more accurate assessment and reduce manual analysis and false positives.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If reactive signature-based detection is used, then detection accuracy for known malware is improved, but the system becomes ineffective against modified malware with superficial changes

Engineering Contradiction:
Improvedetection accuracyVSAvoideffectiveness against modified malware
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent transforms the detection approach from using specific binary fingerprints to using normalized structural parameters (section sizes, symbol counts, entropy values) that remain consistent across malware variants. This parameter transformation allows the system to maintain detection accuracy while adapting to superficial modifications in malware code.

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

Instead of copying the exact binary content for detection, the patent creates a normalized structural representation (a simplified copy) that captures essential characteristics while being invariant to superficial changes. This normalized copy serves as the basis for generic signature matching.

Inventive Principle:
Principle #26Copying

2Adaptability or versatility

If generic signatures are used to detect malware variants, then adaptability to modified malware is improved, but false positives increase

Engineering Contradiction:
Improvedetection of malware variantsVSAvoidfalse positive rate
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary analysis by extracting and normalizing structural parameters before creating generic signatures. This preliminary structuring action ensures that signatures are based on stable, meaningful characteristics, reducing the likelihood of false positives while maintaining variant detection capability.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent replaces manual signature creation with automated machine learning techniques that learn optimal parameter combinations from training data. This substitution reduces human error and bias, leading to more reliable generic signatures with lower false positive rates.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If manual analysis is used to establish malware signatures, then detection accuracy is improved, but the process becomes time-consuming and requires human intervention

Engineering Contradiction:
Improvesignature accuracyVSAvoidtime for signature creation
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system enables self-service by allowing malware samples to automatically train the machine learning model. The system extracts features, learns patterns, and generates detection rules autonomously without requiring manual analysis, thereby maintaining accuracy while eliminating time loss and human intervention.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The patent substitutes manual expert analysis with automated machine learning algorithms that perform feature extraction, pattern recognition, and signature generation. This mechanical substitution maintains detection precision while dramatically reducing the time and human resources required.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

4Adaptability or versatility

If frequent malware updates with innocuous changes are made, then malware authors can evade detection, but the number of unique malware instances increases

Engineering Contradiction:
Improvemalware evasion capabilityVSAvoidnumber of malware instances
Core Design Contradiction:
Adaptability or versatilityVSQuantity of substance

Solution Approach 1:

The patent creates universal generic signatures that can detect multiple malware variants simultaneously. Instead of requiring separate signatures for each malware instance, a single generic signature based on normalized structural parameters can identify entire families of related malware, reducing the quantity of unique detection rules needed while maintaining evasion resistance.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2646911B1Detecting malicious software through contextual convictions, generic signatures and machine learning techniques
Publication Date: 2018.04.04 CISCO TECHNOLOGY INC
  • EP2646911B1 patent drawingFigure 1
  • EP2646911B1 patent drawingFigure 2
  • EP2646911B1 patent drawingFigure 3

AI summary

Novel methods, components, and systems that enhance traditional techniques for detecting malicious software are presented. More specifically, methods, components, and systems that use important contextual information from a client system (such as recent history of events on that system), machine learning techniques, the automated deployment of generic signatures, and combinations thereof, to detect malicious software. The disclosed invention provides a significant improvement with regard to automation compared to previous approaches.