Malware Detection via Event Subsequence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malware are inadequate in accurately and timely preventing damage to computing systems, as they often fail to effectively identify malicious software, especially when it operates stealthily and disguises itself as non-malicious files.
Innovation Solution
A system utilizing a machine learning model, specifically a recurrent neural network with a long short-term memory network, analyzes a series of events during data object execution to extract subsequences and classify data as malicious, employing techniques like the Apriori algorithm and Markov chains to identify non-consecutive correlated events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional anti-virus and anti-malware software are used to detect malware, then basic protection against known malware is provided, but the detection accuracy and timeliness are insufficient to effectively identify stealthy malware disguised as non-malicious files
Solution Approach 1:
The patent segments malware detection into multiple analysis dimensions: static analysis of file attributes, dynamic analysis of execution behavior, and sequence analysis of system calls. By dividing the detection process into these independent segments, the system can identify malware through multiple indicators rather than relying on a single method, thereby improving detection accuracy while maintaining reliability
Solution Approach 2:
The system performs preliminary analysis by extracting and analyzing sequences of system calls and execution behaviors before malware can cause significant damage. By proactively monitoring the sequence of operations during execution, the system can identify malicious patterns early in the malware lifecycle, improving both detection accuracy and response timeliness
2Measurement precision
If dynamic analysis of execution events is performed to improve malware detection accuracy, then the ability to detect stealthy malware is enhanced, but the computational complexity and analysis time increase
Solution Approach 1:
The patent extracts only the most relevant features from execution events, specifically focusing on sequences of system calls and key behavioral patterns. By extracting and analyzing only these critical subsequences rather than processing all execution events in detail, the system maintains high detection accuracy while reducing computational complexity
Solution Approach 2:
The system changes the analysis parameter from examining individual isolated events to analyzing sequences of events over time. By transforming the data representation into temporal sequences and using sequence matching algorithms, the system achieves higher detection accuracy through pattern recognition while managing complexity through efficient sequence processing
3Reliability
If comprehensive analysis of all execution events is performed to ensure accurate malware classification, then detection reliability is improved, but the processing time and resource consumption increase
Solution Approach 1:
The patent applies partial action by analyzing only the most discriminative subsequences of system calls rather than processing every execution event in detail. By identifying and focusing on key behavioral sequences that are most indicative of malware, the system achieves reliable classification while significantly reducing processing time and resource consumption
Data Source
AI summary
In some implementations there may be provided a system. The system may include a processor and a memory. The memory may include program code which causes operations when executed by the processor. The operations may include analyzing a series of events contained in received data. The series of events may include events that occur during the execution of a data object. The series of events may be analyzed to at least extract, from the series of events, subsequences of events. A machine learning model may determine a classification for the received data. The machine learning model may classify the received data based at least on whether the subsequences of events are malicious. The classification indicative of whether the received data is malicious may be provided. Related methods and articles of manufacture, including computer program products, are also disclosed.