Malware Family-Tree Generation for Concept Drift Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods fail to account for concept drift due to time changes, leading to reduced detection accuracy over time, especially when new malware families emerge.
Innovation Solution
A system that generates a software family tree by clustering malware based on feature quantities, using a center of gravity to match past and current clusters, and detects concept drift to update machine learning models with new data sets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware detection is performed using traditional machine learning models trained on historical data, then detection accuracy is maintained initially, but detection accuracy deteriorates over time due to concept drift when new malware families emerge
Solution Approach 1:
The system continuously monitors clustering results and compares them with historical data to detect concept drift. When drift is detected, the system triggers model retraining with updated data, creating a feedback loop that maintains detection accuracy over time without requiring continuous manual retraining
Solution Approach 2:
The system dynamically adapts to changing malware characteristics by detecting concept drift and automatically updating the machine learning model. This transforms the static detection system into a dynamic one that evolves with emerging malware threats
2Reliability
If continuous retraining of machine learning models is performed to maintain detection accuracy, then detection accuracy is maintained, but computational resources and time are consumed
Solution Approach 1:
Instead of performing continuous full model retraining, the system performs partial updates only when concept drift is detected through clustering analysis. This reduces unnecessary computational overhead while maintaining detection accuracy by retraining only when needed
Solution Approach 2:
The system performs preliminary clustering analysis on new malware data before triggering full model retraining. This preliminary action identifies whether concept drift has occurred, allowing the system to avoid unnecessary retraining operations and conserve computational resources
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The generation device (10) includes: an acquisition unit (15a) for acquiring information on software, an extraction unit (15b) for extracting a feature quantity of software from the information on software acquired by the acquisition unit (15a), a determination unit 15b for determining, a clustering unit (15c) for generating cluster for each software and calculating a clustering result including a center of gravity of cluster on the basis of feature quantity of software extracted by extraction unit (15b), a matching unit (15d) for matching the clustering result calculated by the clustering unit (15c) with the past clustering result when a distance between the center of gravity of the cluster included in the past clustering result calculated from the information of the malware, and a generation unit (15e) for generating a graph showing the relationship between the software and the malware on the basis of the result of matching by the matching unit (15d).