Malware Detection via Probability Space Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus technologies face inefficiencies in detecting malicious files with unique characteristics, often requiring excessive resource usage and failing to detect new or unfamiliar malicious programs, leading to suboptimal detection methods and high false positives.
Innovation Solution
A method involving a mapping model that characterizes files in a probability space to determine their association with malicious families, allowing for the selection of optimal detection methods based on file characteristics and behavior, thereby optimizing resource utilization and detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis methods are used to detect new malicious programs, then detection effectiveness is improved, but computing resource consumption increases
Solution Approach 1:
The detection system is divided into multiple independent modules: a mapping model generation module that creates probability space representations, a file characteristic analysis module that extracts features, and a detection method selection module that chooses appropriate analysis approaches. This segmentation allows the system to perform lightweight mapping operations separately from resource-intensive dynamic analysis, enabling effective malware detection while controlling resource usage by only applying heavy analysis when necessary.
2Reliability
If multiple detection methods are applied in succession to ensure reliable detection, then detection reliability is improved, but processing time increases
Solution Approach 1:
The system performs preliminary mapping of files into probability space before actual malware detection. This preliminary action creates a compact representation that enables rapid comparison and classification. By establishing these probability space mappings in advance, the system can quickly determine which detection methods are appropriate without performing multiple full analysis passes, thereby reducing overall processing time while maintaining reliable detection through subsequent targeted analysis.
3Productivity
If fast detection methods like signature analysis are used, then processing speed is improved, but detection accuracy for new malware decreases
Solution Approach 1:
The system transforms file characteristics into probability space representations, changing the parameter domain from raw binary data to probabilistic distributions. This parameter transformation enables the system to use fast comparison operations in the probability space while capturing nuanced behavioral patterns that signature-based methods miss. The mapping model converts diverse file features into standardized probability vectors that can be rapidly compared against known malware families, maintaining high processing speed while improving detection accuracy for novel threats through probabilistic pattern recognition.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for detection of malicious files includes training a mapping model for mapping files in a probability space. A plurality of characteristics of an analyzed file is determined based on a set of rules. A mapping of the analyzed file in probability space is generated based on the determined plurality of characteristics. A first database is searched using the generated mapping of the analyzed file to determine whether the analyzed file is associated with a family of malicious files. The first database stores mappings associated with one or more families of malicious files. In response to determining that the analyzed file is associated with the family of malicious files, a selection of one or more methods of malware detection is made from a second database. The second database stores a plurality of malware detection methods. The selected method is used to detect the associated family.