Malware Detection via High-Level Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods relying on signatures become less effective as new malware variants are designed to evade detection, posing a challenge in efficiently and accurately identifying malicious program code.
Innovation Solution
The use of high-level features extracted from binary files, such as file size, entropy, and organizational characteristics, evaluated through a decision tree classification engine to determine the likelihood of a file being malicious, allowing for more effective malware detection beyond traditional signature-based methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used, then known malware can be detected, but new or unknown malware variants cannot be effectively detected
Solution Approach 1:
The patent changes the detection parameters from fixed signatures to dynamic high-level features such as file size, entropy, section organization, and import characteristics. These parameters can vary across malware variants while maintaining detection capability, allowing the system to adapt to new threats without requiring updated signatures for each variant.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a classification engine that uses machine learning algorithms. This substitution enables the system to automatically learn and adapt to new malware patterns through training data, rather than relying on manual signature updates, thereby improving both accuracy and adaptability to emerging threats.
2Measurement precision
If high-level feature extraction and classification is used, then detection accuracy for new malware improves, but computational complexity increases
Solution Approach 1:
The patent segments the malware detection process into distinct modules: feature extraction module, classification engine, and decision-making component. Each module handles specific tasks independently, making the overall complex system more manageable and maintainable while preserving high detection accuracy through specialized processing at each stage.
Solution Approach 2:
The patent introduces high-level feature extraction as an intermediary layer between the raw binary file and the classification engine. This intermediary transforms complex binary data into meaningful characteristics (entropy, file size, section organization), simplifying the classification task and reducing the computational burden on the detection system while maintaining accuracy.
3Reliability
If comprehensive feature analysis is performed, then false positives are reduced, but processing time increases
Solution Approach 1:
The patent performs preliminary feature extraction and analysis before final classification decisions. By pre-computing high-level features such as entropy, file size, and section characteristics, the system prepares data in advance that enables faster and more accurate classification, reducing both false positives and processing time during actual malware detection operations.
Data Source
AI summary
A computer network device receives a digital file and extracts a plurality of high level features from the file. The plurality of high level features are evaluated using a classifier to determine whether the file is benign or malicious. The file is forwarded to a requesting computer if the file is determined to be benign, and blocked if the file is determined to be malicious.