Malware Detection Model Training via Behavior Pattern Convolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in detecting malicious files with unique characteristic attributes, despite employing static and dynamic analysis, and lack effective mechanisms for machine learning model testing, retraining, and attribute formation.
Innovation Solution
A system and method for machine learning a model to detect malicious files, involving selecting a training file, generating behavior logs, determining convolution functions, training a detection model, and using it to assess the harmfulness of target files based on behavior patterns and parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is used to improve detection effectiveness, then the percentage of detecting malicious programs increases, but the speed of analysis decreases and resource consumption increases
Solution Approach 1:
The system performs preliminary actions by generating behavior logs and training detection models in advance using static analysis data. This allows the model to learn malicious behavior patterns before actual detection, enabling faster real-time analysis without requiring full dynamic analysis of every file.
Solution Approach 2:
The detection process is segmented into two phases: offline model training using static analysis and behavior logs, and online detection using the trained model. This segmentation allows resource-intensive analysis to be performed beforehand, making real-time detection faster and more efficient.
2Productivity
If static analysis is used to improve analysis speed, then the resource consumption decreases, but the detection effectiveness and percentage of detecting malicious programs decreases
Solution Approach 1:
Behavior logs serve as an intermediary that bridges static and dynamic analysis. The system generates behavior logs from static analysis of executable commands, creating a training dataset that captures malicious behavior patterns without requiring full dynamic execution. This intermediary enables the model to learn from dynamic-like data while maintaining the speed and resource efficiency of static analysis.
Solution Approach 2:
The system creates copies of behavior patterns from static analysis data to train the detection model. Instead of performing actual dynamic execution for every training sample, the system generates behavioral data copies that represent malicious patterns, allowing the model to learn effective detection features without the resource cost of full dynamic analysis.
3Reliability
If traditional signature analysis is used to detect known malicious programs, then the detection of well-known malicious programs is effective, but the detection of new malicious programs with unknown behavior patterns fails
Solution Approach 1:
The detection model is designed to be dynamic and adaptive, continuously learning from new behavior logs and training data. Unlike static signature databases, the model can update its understanding of malicious patterns, enabling it to detect both known and newly emerging threats by adapting to new behavior patterns as they appear.
Solution Approach 2:
The system changes the detection parameters from fixed signatures to learned behavioral features. By training on behavior logs that capture executable commands and system interactions, the model learns parameter-based patterns of malicious behavior that can generalize to new threats, rather than relying on exact signature matches.
Data Source
AI summary
Disclosed are systems and methods for machine learning of a model for detecting malicious files. The described system samples files from a database of files and trains a detection model for detecting malicious files on the basis of an analysis of the sampled files. The described system forms behavior logs based on executable commands intercepted during execution of the sampled files, and generates behavior patterns based on the behavior log. The described system determines a convolution function based on the behavior patterns, and trains a detection model for detecting malicious files by calculating parameters of the detection model using the convolution function on the behavior patterns. The trained detection model may be used to detect malicious files by utilizing the detection model on a system behavior log generated during execution of suspicious files.