Malware Detection System Using Bayesian Classifier for Script Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques face challenges in detecting script-based malware, particularly heap spray attacks, due to significant processing overhead, making it infeasible for implementation in real-time web browser security suites.
Innovation Solution
A malware detection system that utilizes a collection of known malicious and benign code features to train a classifier, allowing for the characterization of unclassified code as malicious or benign, and includes a de-obfuscator to extract features from obfuscated script code, using an abstract syntax tree and Bayesian classification to determine code authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing detection techniques are used to detect heap spray attacks, then malware detection capability is improved, but processing overhead increases significantly
Solution Approach 1:
The detection system segments the code analysis process into distinct phases: static analysis of code patterns, dynamic analysis of execution behavior, and classification stages. This segmentation allows each phase to focus on specific detection tasks, improving overall detection capability while managing processing overhead through selective application of analysis methods.
Solution Approach 2:
The system performs preliminary static analysis of code patterns and structures before full execution. By pre-processing code to identify suspicious patterns, allocate heap regions, and detect spray characteristics in advance, the system reduces the computational burden during runtime detection and enables faster real-time analysis.
2Reliability
If existing detection techniques are used to detect heap spray attacks, then malware detection capability is improved, but real-time detection feasibility deteriorates
Solution Approach 1:
The system replaces complex mechanical analysis methods with pattern recognition and classification algorithms. By substituting exhaustive dynamic analysis with pre-trained classifiers that recognize malware patterns, the system achieves high detection accuracy while maintaining real-time performance suitable for web browser integration.
Solution Approach 2:
The system changes detection parameters dynamically based on code characteristics. It adjusts analysis depth, sampling rates, and classification thresholds according to the specific code being analyzed, enabling efficient real-time detection by focusing computational resources on the most relevant parameters for each detection scenario.
3Measurement precision
If comprehensive code analysis is performed to accurately classify malicious code, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system applies partial analysis to most code and reserves comprehensive analysis for suspicious cases. By performing lightweight initial screening and only applying full comprehensive analysis when malware indicators are detected, the system maintains high detection accuracy while minimizing average processing time across all code analysis requests.
Solution Approach 2:
The system implements feedback mechanisms where detection results from initial analysis phases inform subsequent analysis depth. Classification outcomes and detected patterns feed back into the analysis process, allowing the system to adjust its approach and achieve accurate classification with optimized processing time by avoiding unnecessary comprehensive analysis of benign code.
Data Source
AI summary
This document describes techniques for detection of code-based malware. According to some embodiments, the techniques utilize a collection of known malicious code and know benign code and determine which features of each type of code can be used to determine whether unclassified code is malicious or benign. The features can then be used to train a classifier (e.g., a Bayesian classifier) to characterize unclassified code as malicious or benign. In at least some embodiments, the techniques can be used as part of and/or in cooperation with a web browser to inspect web content (e.g., a web page) to determine if the content includes code-based malware.