Malware Detection Using MinHash Signatures and CNN-AE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques face challenges in effectively identifying and preventing advanced malwares due to high false positive rates and low true positive rates, especially with the use of obfuscation, polymorphism, and metamorphism techniques, rendering static analysis and existing ML-based methods less effective.
Innovation Solution
A system and method that utilizes MinHash signatures and a Convolutional Neural Network Autoencoder (CNN-AE) to classify Portable Executable (PE) files by converting entry point bytes and assembly-based mnemonics into similarity matrices, leveraging locality sensitive hashing (LSH) forest models for reliable and fast malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static malware analysis techniques are used, then detection speed is improved, but detection accuracy deteriorates due to obfuscation techniques
Solution Approach 1:
The patent replaces traditional static analysis methods with a neural network-based dynamic analysis system. The system executes malware in a virtualized environment and captures runtime behavioral data, substituting mechanical static inspection with intelligent dynamic observation to achieve both speed and accuracy.
Solution Approach 2:
The patent introduces a virtualization layer as an intermediary between the malware and the analysis system. This allows safe execution and observation of malware behavior without direct interaction, enabling accurate detection while maintaining system security and detection speed.
2Measurement precision
If ML-based malware detection techniques are used, then detection accuracy is improved, but false positive rate increases
Solution Approach 1:
The patent segments the malware analysis into multiple independent components: binary representation analysis, assembly instruction analysis, API call analysis, and behavioral pattern analysis. Each component contributes specific features to the neural network, allowing for more precise and reliable detection with reduced false positives.
Solution Approach 2:
The patent transforms malware characteristics into multiple parameter representations including binary sequences, assembly mnemonics, API call graphs, and behavioral metrics. These transformed parameters are fed into the neural network to improve detection accuracy while maintaining reliability through multi-dimensional analysis.
3Reliability
If comprehensive malware analysis is performed, then detection reliability is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary processing by pre-computing and storing malware signatures, API reference patterns, and behavioral baselines before actual detection. During runtime, the system compares observed behavior against these pre-prepared references, achieving comprehensive analysis with reduced processing time.
Solution Approach 2:
The patent implements continuous learning and updating of the neural network model using newly detected malware patterns. The system continuously refines its detection capabilities without requiring complete re-analysis, maintaining high reliability while minimizing processing time through incremental improvements.
Data Source
AI summary
The disclosed systems and methods are directed to a method for malicious software detection comprising: recognizing and extracting an EP section in an unrecognized PE file, collecting bytes in the EP section of the unrecognized PE file, converting the bytes to an array of integers, generating one or more n-grams from the array of integers, converting the one or more n-grams into b-MinHash, converting the bytes in an EP function included in the EP section to an array of assembly-based mnemonics; generating one or more n-grams from the array of assembly-based mnemonics and converting the one or more n-grams from the array of assembly-based mnemonics into a-MinHash, generating a similarity matrices, converting, the similarity matrices into a lower dimensionality code representation, and classifying the code as a PE benign or a malware file.