Malware Detection via Local Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems using machine learning algorithms face challenges in training models while protecting user privacy, as they often require centralized data storage of user files, raising privacy concerns and requiring large storage space on central servers.
Innovation Solution
A system that performs static and behavioral analyses of downloaded files on user devices, breaking them into chunks to extract features and hashes, which are then sent to a central server for training machine learning models without transmitting the entire file, thus preserving user privacy and reducing storage needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized data storage of user files is used for training machine learning models, then model training effectiveness is improved, but user privacy protection deteriorates
Solution Approach 1:
The patent extracts only the necessary features (hashes, structural features, behavioral features) from user files and transmits them to the central server for model training, while leaving the actual user files on local devices. This extraction approach enables effective model training using representative data without exposing sensitive user privacy information.
2Reliability
If entire user files are transmitted to central server for training, then training data quality is improved, but network bandwidth consumption and storage requirements worsen
Solution Approach 1:
The system extracts only essential features from complete user files, specifically file hashes, structural features, and behavioral features. These extracted features constitute a minimal data set that maintains training quality while dramatically reducing the volume of data that needs to be transmitted and stored on central servers.
Solution Approach 2:
The patent segments the file analysis process into multiple stages: local feature extraction on user devices, selective transmission of extracted features to the central server, and model training using these segmented feature sets. This segmentation enables efficient processing and reduces overall data handling requirements.
Data Source
AI summary
Systems and methods for malware detection are provided herein. In some embodiments, a system having one or more processors is configured to: perform, on a plurality of user devices, at least one of a static analysis or a behavioral analysis of a file downloaded to a user device; receive a plurality of features extracted from the downloaded file; train at least one machine learning model, on a central server in communication with the plurality of user device, based on the plurality of features; distribute the at least one trained machine learning model to the plurality of user devices; and update at least one of a machine learning model used for the static analysis or behavioral analysis with the distributed at least one trained machine learning model.