Malware Detection via Contextual Convictions and ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are reactive and prone to false positives, as they rely on specific signatures that can change with superficial modifications, and require manual intervention, making them ineffective against frequent innocuous changes to malicious software.
Innovation Solution
A system that uses contextual information and machine learning to determine the maliciousness of software applications, combining traditional fingerprints, generic signatures, and contextual data such as recent infections and geographic location, to provide a more accurate assessment and reduce manual analysis and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If reactive signature-based detection is used, then detection accuracy for known malware is improved, but the system becomes ineffective against modified malware with superficial changes
Solution Approach 1:
The patent transforms the detection approach from using specific binary fingerprints to using normalized structural parameters (section sizes, symbol counts, entropy values) that remain consistent across malware variants. This parameter transformation allows the system to maintain detection accuracy while adapting to superficial modifications in malware code.
Solution Approach 2:
Instead of copying the exact binary content for detection, the patent creates a normalized structural representation (a simplified copy) that captures essential characteristics while being invariant to superficial changes. This normalized copy serves as the basis for generic signature matching.
2Adaptability or versatility
If generic signatures are used to detect malware variants, then adaptability to modified malware is improved, but false positives increase
Solution Approach 1:
The system performs preliminary analysis by extracting and normalizing structural parameters before creating generic signatures. This preliminary structuring action ensures that signatures are based on stable, meaningful characteristics, reducing the likelihood of false positives while maintaining variant detection capability.
Solution Approach 2:
The patent replaces manual signature creation with automated machine learning techniques that learn optimal parameter combinations from training data. This substitution reduces human error and bias, leading to more reliable generic signatures with lower false positive rates.
3Measurement precision
If manual analysis is used to establish malware signatures, then detection accuracy is improved, but the process becomes time-consuming and requires human intervention
Solution Approach 1:
The system enables self-service by allowing malware samples to automatically train the machine learning model. The system extracts features, learns patterns, and generates detection rules autonomously without requiring manual analysis, thereby maintaining accuracy while eliminating time loss and human intervention.
Solution Approach 2:
The patent substitutes manual expert analysis with automated machine learning algorithms that perform feature extraction, pattern recognition, and signature generation. This mechanical substitution maintains detection precision while dramatically reducing the time and human resources required.
4Adaptability or versatility
If frequent malware updates with innocuous changes are made, then malware authors can evade detection, but the number of unique malware instances increases
Solution Approach 1:
The patent creates universal generic signatures that can detect multiple malware variants simultaneously. Instead of requiring separate signatures for each malware instance, a single generic signature based on normalized structural parameters can identify entire families of related malware, reducing the quantity of unique detection rules needed while maintaining evasion resistance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Novel methods, components, and systems that enhance traditional techniques for detecting malicious software are presented. More specifically, methods, components, and systems that use important contextual information from a client system (such as recent history of events on that system), machine learning techniques, the automated deployment of generic signatures, and combinations thereof, to detect malicious software. The disclosed invention provides a significant improvement with regard to automation compared to previous approaches.