Malware Detection Feature Analysis Code Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods face challenges in reducing false positives due to the selection and distribution of unsuitable features, leading to increased workload and user dissatisfaction, despite efforts to eliminate common features between clean files and malware.
Innovation Solution
A method that subdivides file code into unique code blocks, identifies standard sections of code, and creates a database to disregard these sections during malware detection, reducing false positives and improving processing efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If feature analysis is used to detect malware, then detection capability is improved, but false positives increase
Solution Approach 1:
The code is divided into multiple code blocks, and features are extracted from specific segments rather than the entire code. This allows focusing on discriminative portions while ignoring common standard sections, thereby improving detection accuracy while reducing false positives.
Solution Approach 2:
Standard sections of code that appear in both clean and malware files are identified and extracted/removed from the feature analysis process. By taking out these common elements, the system focuses only on the unique, discriminative features that actually indicate malware, reducing false positives while maintaining detection capability.
2Reliability
If comprehensive feature collection is performed on all code sections, then detection coverage is improved, but processing time increases
Solution Approach 1:
The code is segmented into code blocks, and only certain segments are selected for detailed feature analysis. This segmentation allows the system to process fewer, more relevant sections of code, reducing processing time while maintaining comprehensive detection coverage through strategic selection of analysis targets.
Solution Approach 2:
Standard sections are identified and marked for exclusion before the main feature collection process. This preliminary action prevents unnecessary feature extraction and analysis of common code patterns, significantly reducing processing time while ensuring that only discriminative features are collected for detection.
3Measurement precision
If empirical feature rejection is performed on large datasets, then feature quality is improved, but computational resources increase
Solution Approach 1:
The code is divided into code blocks for targeted analysis. This segmentation allows efficient comparison and identification of standard sections without requiring exhaustive analysis of entire datasets, improving feature selection accuracy while reducing computational resource requirements.
Solution Approach 2:
Instead of performing exhaustive feature rejection analysis on all possible features and datasets, the system applies partial action by focusing only on identifying and excluding standard sections. This partial approach achieves sufficient feature quality improvement without the prohibitive computational cost of complete exhaustive analysis.
Data Source
AI summary
A method of identifying sections of code that can be disregarded when detecting features that are characteristic of malware, which features are subsequently used for detecting malware. The method includes, for each of a multiplicity of sample files, subdividing file code of the sample file into a plurality of code blocks and then removing duplicate code blocks to leave a sequence of unique code blocks. The sequence of unique code blocks is then compared with those obtained for other sample files in order to identify standard sections of code. The standard sections of code identified are then included within a database such that those sections of code can subsequently be disregarded when identifying features characteristic of malware.