Malware Detection via Dual Neural Network Weight Unification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware identification methods using single neural networks suffer from unsatisfactory detection rates and high false positive rates due to reliance on static information, making it difficult to distinguish between malware and benign software, especially with the presence of noise in code samples.
Innovation Solution
The use of multiple neural networks that share and adjust weight and bias information during training on distinct features of a common sample set, where each network focuses on either static or dynamic features of code blocks, allowing for a supervised learning process that criticizes and unifies their weights and biases to enhance malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a single neural network focusing on static information is used for malware identification, then the system complexity is low, but the detection accuracy is unsatisfactory and false positive rate is high
Solution Approach 1:
The system divides the malware detection task into two separate neural networks: one specializing in static analysis and another in dynamic analysis. Each network processes specific features independently before their results are combined, allowing specialized processing that improves detection accuracy while maintaining manageable complexity through functional separation
Solution Approach 2:
The system transitions from a single-dimension approach (static or dynamic alone) to a multi-dimensional approach by incorporating both static and dynamic feature analysis simultaneously. This adds temporal and behavioral dimensions to the detection process, significantly improving detection accuracy and reducing false positives
2Reliability
If multiple neural networks are used to analyze both static and dynamic features, then the detection accuracy improves, but the training complexity and computational resources increase
Solution Approach 1:
The system implements a feedback mechanism where the dynamic analysis network's results are used to adjust and refine the static analysis network's weights and biases, and vice versa. This mutual feedback loop allows the networks to learn from each other's strengths, improving overall reliability while managing training complexity through iterative refinement rather than complete retraining
Solution Approach 2:
The system merges the outputs of two separate neural networks by combining their weight and bias information through a unified training process. This consolidation allows the system to leverage both static and dynamic feature analysis simultaneously, improving malware identification reliability while managing computational resources through integrated processing
3Measurement precision
If multiple neural networks exchange and unify weights and biases, then the false positive rate reduces and classification improves, but the processing time per sample increases
Solution Approach 1:
The system performs preliminary feature extraction and processing separately for static and dynamic features before feeding them to their respective neural networks. This pre-processing organization allows the networks to receive well-structured input, improving classification accuracy while reducing the computational burden during the actual analysis phase, thus managing processing time
Data Source
AI summary
Systems and methods for malware detection using multiple neural networks are provided. According to one embodiment, for each training sample, a supervised learning process is performed, including: (i) generating multiple code blocks of assembly language instructions by disassembling machine language instructions contained within the training sample; (ii) extracting dynamic features corresponding to each of the code blocks by executing each of the code blocks within a virtual environment; (iii) feeding each code block into a first neural network and the corresponding dynamic features into a second neural network; (iv) updating weights and biases of the neural networks based on whether the training sample was malware or benign; and (v) after processing a predetermined or configurable number of the training samples, causing the neural networks criticize each other and to unify their respective weights and biases by exchanging their respective weights and biases and adjusting their respective weights and biases accordingly.