Computational Models for Malware Detection via Signature Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malware are inefficient in determining whether a program is malicious and identifying its harmful actions without executing it, due to obfuscation techniques used by malware authors, leading to time-consuming and resource-intensive processes.
Innovation Solution
The development of computational models that use signature determination and machine learning techniques, such as neural networks and decision trees, to classify files as malware or non-malware, and to identify their types, by pre-arranging training and validation sets in memory and employing locality-sensitive hashing to reduce time and memory requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used to analyze obfuscated malware without execution, then detection accuracy is maintained, but the process becomes time-consuming and resource-intensive
Solution Approach 1:
The patent pre-computes and stores feature representations (signatures) of malware samples during an offline phase. These pre-computed features are stored in a database for rapid online comparison. This preliminary action separates the computationally intensive feature extraction from the time-critical detection phase, allowing accurate detection without time-consuming real-time analysis.
Solution Approach 2:
The patent extracts and isolates specific static features from malware binaries (such as API call sequences, control flow graph characteristics, and byte pattern signatures) that are most discriminative for malware classification. By extracting only these critical features rather than analyzing the entire binary, the system achieves accurate detection with reduced computational overhead and faster processing.
2Measurement precision
If computational models are trained with large datasets to improve detection accuracy, then model performance increases, but training time and memory requirements increase
Solution Approach 1:
The patent divides the malware detection task into multiple independent feature extraction components (static analysis, control flow analysis, API sequence analysis). Each component processes different aspects of the malware independently and produces separate feature vectors that are later combined. This segmentation allows parallel processing during training and inference, reducing overall training time while maintaining comprehensive analysis for accurate detection.
Solution Approach 2:
The patent transforms raw malware binaries into standardized feature representations (signatures) with controlled dimensionality and format. By changing the parameter representation from raw binary data to structured feature vectors with predetermined dimensions, the system enables efficient storage and rapid processing during both training and detection phases, reducing memory requirements and training time while preserving detection accuracy.
3Reliability
If malware analysis is performed without execution to reduce risks, then safety is improved, but the ability to detect obfuscated malware deteriorates
Solution Approach 1:
The patent introduces static feature extraction as an intermediary between the malware binary and the detection decision. Instead of directly executing or visually inspecting the malware, the system uses automated static analysis tools to extract intermediate representations (feature vectors) that capture the malware's behavior and structure without requiring execution. This intermediary process maintains safety while providing sufficient information for accurate detection of obfuscated malware.
Data Source
AI summary
Example techniques described herein determine a validation dataset, determine a computational model using the validation dataset, or determine a signature or classification of a data stream such as a file. The classification can indicate whether the data stream is associated with malware. A processing unit can determine signatures of individual training data streams. The processing unit can determine, based at least in part on the signatures and a predetermined difference criterion, a training set and a validation set of the training data streams. The processing unit can determine a computational model based at least in part on the training set. The processing unit can then operate the computational model based at least in part on a trial data stream to provide a trial model output. Some examples include determining the validation set based at least in part on the training set and the predetermined criterion for difference between data streams.