Malware Detection via Machine Learning Feature Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are reactive and ineffective against malicious software that undergoes superficial changes, leading to evasion from detection by anti-malware technologies.
Innovation Solution
A system utilizing machine learning techniques to identify malicious software through a training phase, feature extraction, and evaluation phase, employing models like Support Vector Machines and Neural Networks to classify software applications as malicious or benign, with policies applied based on the classification results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional fingerprint-based detection methods are used, then known malicious software can be detected, but malicious software with superficial changes can evade detection
Solution Approach 1:
The patent segments the malware detection problem into multiple independent feature dimensions (behavioral features, structural features, runtime features) rather than relying on a single fingerprint. Each feature is extracted and analyzed separately, then combined to form a comprehensive detection model that can identify malware even when individual features are modified.
Solution Approach 2:
The patent transforms the detection approach from using fixed fingerprint parameters to using dynamic feature parameters that capture the essential characteristics of malware behavior. By changing from static hash values to dynamic behavioral and structural features, the system can detect malware variants that maintain core malicious characteristics despite superficial modifications.
2Reliability
If reactive detection methods are used, then confirmed malware can be blocked, but proactive detection of new malware variants is not possible
Solution Approach 1:
The patent implements preliminary action by training machine learning models on historical malware data before new threats emerge. The system pre-computes feature extractors and detection models that can immediately evaluate new malware variants, eliminating the need to wait for confirmation and response cycles. This allows proactive detection of novel malware as soon as it appears.
3Measurement precision
If machine learning models are trained on comprehensive data, then detection accuracy improves, but computational complexity and training time increase
Solution Approach 1:
The patent segments the training data into distinct feature categories (behavioral, structural, runtime) and trains specialized models for each category. This segmentation allows comprehensive analysis without requiring a single monolithic model, reducing training complexity while maintaining high accuracy through ensembling of specialized models.
Solution Approach 2:
The patent applies partial action by selectively extracting and training on the most discriminative features rather than processing all possible data. The feature extraction phase identifies and focuses on key characteristics that provide the highest detection value, reducing computational burden while maintaining detection effectiveness.
Data Source
AI summary
Novel methods, components, and systems for detecting malicious software in a proactive manner are presented. More specifically, we describe methods, components, and systems that leverage machine learning techniques to detect malicious software. The disclosed invention provides a significant improvement with regard to detection capabilities compared to previous approaches.