Malware Detection via Binary Function Translation and Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Contemporary malware detection systems face challenges in effectively identifying malicious software executable files, as they often rely on dynamic analysis methods that require execution of suspect files and are evaded by modern malware techniques, while static analysis methods are more secure and efficient but may not capture semantic changes and obfuscation patterns.
Innovation Solution
A file classification system that translates binary functions of executable files into symbolic language, clusters operation codes, computes statistical values, and uses a machine learning model to classify files as malicious or benign, allowing for detection without executing the files and reducing the need for frequent updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis methods are used for malware detection, then detection capability is improved, but system security deteriorates due to execution of suspect files
Solution Approach 1:
The patent introduces a virtualized execution environment as an intermediary between the suspect file and the host system. The file is executed in an isolated virtual machine rather than directly on the host, allowing dynamic analysis of malware behavior while preventing harmful effects from reaching the actual system. This resolves the contradiction by enabling detection capability through execution while maintaining system security through isolation.
2Object-affected harmful factors
If static analysis methods are used for malware detection, then system security is improved, but detection precision deteriorates due to inability to capture semantic changes
Solution Approach 1:
The patent segments the analysis process into two distinct phases: static analysis for initial assessment and security isolation, followed by dynamic analysis in a controlled virtual environment for deeper behavioral observation. This segmentation allows the system to benefit from both approaches - the security advantages of static analysis and the precision advantages of dynamic analysis - without suffering from their respective drawbacks.
3Measurement precision
If traditional malware detection systems are used, then detection of known malware is improved, but adaptability to new malware deteriorates due to frequent update requirements
Solution Approach 1:
The patent implements feedback mechanisms where execution data and behavioral patterns observed in the virtualized environment are continuously fed back to update the detection models and signatures. This feedback loop enables the system to automatically learn from new malware samples and adapt to emerging threats without requiring manual intervention for every update, thereby improving adaptability while maintaining detection accuracy.
Data Source
AI summary
A system for training a file classification model for classifying malicious software comprising at least one hardware processor adapted to: computing a plurality of datasets, each for one of a plurality of executable files, each file having a label, each dataset is computed by: receiving a respective file; detecting a plurality of binary functions in the respective file; translating each of the respective plurality of binary functions to produce a plurality of disassembled functions; clustering a plurality of operation-codes identified in the plurality of disassembled functions into a plurality of clusters according to respective operation-code; computing a plurality of statistical values of the plurality of disassembled functions and the plurality of clusters; and associating the plurality of statistical values with the file's label to produce a dataset; and training a file classification model using the plurality of datasets to compute at least one classification score of an input file.