Malware Detection via Behavioral N-gram Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional signature-based malware detection methods fail to detect unknown or evolving malware, as well as imposter programs that disguise themselves as legitimate, leading to incomplete security for computing devices.
Innovation Solution
The system generates n-grams from behavioral traces of programs to analyze sequential features, constructs feature vectors by mapping n-grams onto a reduced space, and uses these vectors to classify programs as malicious or benign through machine learning classifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based malware detection methods are used, then detection of known malware is achieved, but detection of unknown or evolving malware fails
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavior analysis by monitoring runtime behaviors of programs. Behavioral traces capture sequential operations during execution, allowing the system to adapt to new malware variants based on their behavioral patterns rather than relying on pre-defined signatures. This dynamic approach enables detection of previously unseen malware through anomaly detection in behavioral sequences.
Solution Approach 2:
The system changes the detection parameters from fixed malware signatures to variable behavioral features extracted from runtime traces. By transforming behavioral data into feature vectors that capture essential characteristics of program execution, the system can detect malware based on behavioral deviations rather than code matching. This parameter transformation enables detection of malware that has been obfuscated or modified to evade signature-based detection.
2Measurement precision
If behavioral traces are analyzed in full detail, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The system extracts only the most relevant features from comprehensive behavioral traces by transforming raw behavioral data into condensed feature vectors. This extraction process selects and emphasizes key behavioral characteristics while discarding redundant information, achieving high detection accuracy with reduced computational complexity. The feature transformation step isolates the essential signal from the noisy behavioral trace data.
Solution Approach 2:
The system applies partial action by focusing analysis on specific subsets of behavioral features rather than processing all possible trace data. By selecting relevant behavioral dimensions and applying feature transformation to only those aspects, the system achieves effective malware detection without the computational burden of complete behavioral analysis. This selective approach maintains detection effectiveness while reducing complexity.
Data Source
AI summary
A computer-implemented method for detecting malware may include (1) identifying a behavioral trace of a program, the behavioral trace including a sequence of runtime behaviors exhibited by the program, (2) dividing the behavioral trace to identify a plurality of n-grams within the behavioral trace, each runtime behavior within the sequence of runtime behaviors corresponding to an n-gram token, (3) analyzing the plurality of n-grams to generate a feature vector of the behavioral trace, and (4) classifying the program based at least in part on the feature vector of the behavioral trace to determine whether the program is malicious. Various other methods, systems, and computer-readable media are also disclosed.