Malware Detection Using Entropy Vector Inspection Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods, particularly static and dynamic detection, face challenges in efficiently and effectively identifying and destroying malware files due to low detection speed, poor heuristic ability, and inefficiency in detecting newly emerged malware.
Innovation Solution
A method involving the acquisition of entropy vectors from files, training an inspection model using labeled malware and non-malware files, and utilizing this model to determine if a file is malicious based on its entropy vector features, with iterative refinement to achieve a misjudgment rate below a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static detection method is used to detect malware files, then the detection process is simple and fast, but the heuristic ability is poor and cannot detect newly emerged malware files
Solution Approach 1:
The patent combines static detection and dynamic detection methods into a unified detection system. The system performs both static analysis (file structure, characteristics) and dynamic analysis (behavioral patterns, execution traces) simultaneously, merging the speed advantage of static detection with the heuristic capability of dynamic detection to resolve the contradiction between detection speed and heuristic ability
Solution Approach 2:
The patent introduces dynamic detection capabilities that allow the system to adaptively respond to different malware types. By implementing dynamic behavioral analysis and machine learning-based classification, the system gains the ability to evolve its detection strategies, transforming a static detection approach into a dynamic one that maintains both speed and adaptability
2Adaptability or versatility
If dynamic detection method is used to detect malware files, then the heuristic ability is improved, but the detection speed and efficiency are reduced
Solution Approach 1:
The patent implements preliminary static detection before dynamic detection. By first performing quick static analysis on file characteristics and structure, the system can filter out obviously malicious files immediately, reserving dynamic detection resources for suspicious files that require deeper analysis, thus maintaining high detection speed while preserving heuristic capability
Solution Approach 2:
The patent applies partial dynamic detection by selecting only specific files for dynamic analysis based on static detection results. Instead of applying full dynamic detection to all files, the system performs partial dynamic analysis on suspicious cases, reducing overall detection time while maintaining high heuristic ability where needed
3Productivity
If static detection method is used, then the detection process is efficient, but the ability to detect and destroy malware files is poor
Solution Approach 1:
The patent implements feedback mechanisms where detection results from both static and dynamic methods are continuously evaluated and used to refine detection models. The system learns from detected malware patterns and updates its detection algorithms, creating a feedback loop that improves both detection efficiency and reliability over time through adaptive optimization
Data Source
AI summary
The present application discloses a method, an apparatus and a terminal for detecting a malware file. One embodiment of the method comprises: obtaining a file to be inspected; determining an entropy vector of the file; and inspecting the entropy vector of the file using a trained inspection model to determine if the file is a malware file, wherein a file type of the file is identical to the file type corresponding to the inspection model. This embodiment extracts the entropy vector of the file and determines if the file is a malware file based on the entropy vector of the file. Therefore, the technical problems existed in the art, such as a low speed, a poor capacity and a low efficiency of detecting and destroying the malware file, are addressed and the efficiency of detecting and destroying the malware file is enhanced.