Malware Detection Using Normalized Abstract Syntax Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems rely heavily on signature and checksum methods, which are ineffective against new variants and require manual analysis, and emulation-based approaches are costly and error-prone, failing to provide proactive protection against zero-day malware.
Innovation Solution
A communication system that generates normalized abstract syntax trees (ASTs) and computes checksums for malware scripts, using machine-learning to classify threats based on structure rather than content, allowing for proactive detection of new malware variants without full emulation, and dynamically adjusts detection parameters for improved accuracy and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature and checksum methods are used for malware detection, then detection accuracy for known malware is improved, but the system becomes ineffective against new variants and requires manual analysis
Solution Approach 1:
The patent transforms malware detection from content-based parameters (signatures, checksums) to structure-based parameters (AST node types, edges, relationships). By changing the detection parameters from what malware says it is to how malware is organized structurally, the system achieves both accuracy for known malware and adaptability to new variants, as structural patterns remain consistent even when content changes.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine-learning-based structural analysis system. Instead of manually creating and updating signature databases, the system uses ML models trained on AST structures to automatically detect malware, eliminating the need for manual analysis while maintaining high accuracy across known and new variants.
2Reliability
If emulation-based approaches are used for malware detection, then proactive protection against zero-day malware is improved, but the system becomes costly and error-prone
Solution Approach 1:
The patent extracts only the essential structural features of malware (AST nodes and edges) without requiring full emulation of the malware's execution environment. By taking out just the syntactic structure needed for classification, the system achieves proactive protection against zero-day malware while avoiding the complexity and costs of complete emulation systems.
Solution Approach 2:
The patent creates simplified structural copies (AST representations) of malware instead of using full functional copies through emulation. These structural copies capture the essential characteristics needed for detection while being computationally inexpensive and error-free compared to actual malware execution in emulated environments.
3Measurement precision
If manual rule authoring is used for malware classification, then detection accuracy is improved, but the system becomes less scalable and more time-consuming
Solution Approach 1:
The patent enables the system to automatically learn and classify malware through machine learning models trained on AST structures, eliminating the need for manual rule authoring. The ML models self-improve by learning from training data, maintaining high classification accuracy while dramatically increasing scalability and reducing the time required to detect new malware variants.
Solution Approach 2:
The patent performs preliminary training of machine learning models on labeled malware data before actual detection. This preliminary action creates reusable classification knowledge that can be applied to new malware without manual intervention, achieving both high accuracy and scalability by preparing the system in advance rather than relying on real-time manual rule creation.
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to receive script data, determine a checksum tree for the script data, compare each checksum of the checksum tree to one or more subtree checksums, and assign one or more classifications to the script data. In one example, the checksum tree is an abstract syntax tree.