Machine Learning Malware Detection Using Entropy-Based File Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems are time-consuming and resource-intensive, and methods relying on file type knowledge lead to high false positives due to natural file modifications, necessitating frequent database updates.
Innovation Solution
A malware detection device uses machine learning techniques to analyze file informational entropy and other features without relying on file type, employing modules like a file compressor, informational entropy calculator, and threat analyzer to generate a threat model and score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection systems compare each malware sample to a potential malware file sample using known malware databases, then detection accuracy is improved, but detection time and resource consumption increase significantly
Solution Approach 1:
The patent extracts only the essential characteristics of malware (informational entropy, byte value ranges, string lengths, hash values) rather than comparing entire files. This extraction approach maintains detection accuracy while dramatically reducing the time and resources needed for comparison.
Solution Approach 2:
Instead of storing and comparing complete malware files, the system creates simplified copies or representations of malware through statistical features (entropy values, byte distributions, string characteristics). These feature copies enable rapid comparison while preserving the ability to detect malware presence.
2Reliability
If rule-based systems use knowledge of expected byte arrangement in files to detect malware, then detection capability is improved, but false positives increase due to natural file modifications
Solution Approach 1:
The patent changes the detection parameters from fixed byte arrangement rules to statistical parameters (informational entropy, byte value distributions, string length frequencies). These parameters naturally adapt to file modifications while maintaining sensitivity to malware, reducing false positives caused by legitimate file changes.
Solution Approach 2:
Instead of checking whether files match expected byte arrangements (traditional approach), the system inverts the approach by analyzing whether files exhibit abnormal statistical characteristics. This inversion allows natural variations in file structure while detecting genuine malware anomalies.
3Adaptability or versatility
If rule-based systems maintain knowledge of expected byte arrangement for a large number of file types, then detection coverage is improved, but resource requirements increase significantly
Solution Approach 1:
The patent creates a universal detection system that uses the same statistical feature extraction method (informational entropy, byte distributions, string analysis) across all file types. This single multi-functional approach replaces the need for separate byte arrangement knowledge for each file type, reducing resource requirements while maintaining broad detection coverage.
Data Source
AI summary
Apparatus and methods describe herein, for example, a process that can include receiving a potentially malicious file, and dividing the potentially malicious file into a set of byte windows. The process can include calculating at least one attribute associated with each byte window from the set of byte windows for the potentially malicious file. In such an instance, the at least one attribute is not dependent on an order of bytes in the potentially malicious file. The process can further include identifying a probability that the potentially malicious file is malicious, based at least in part on the at least one attribute and a trained threat model.