Malware Detection Using Hierarchical Control Flow Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are insufficient in identifying malicious executable files due to their increasing evasiveness, as they rely on superficial analysis and human expertise, which becomes untenable with the growing number and diversity of malware forms.
Innovation Solution
A device disassembles executable files into assembly instructions, maps them to fixed-length instruction vectors using one-hot encoding, forms vector representations of control flow graphs, generates a call graph model, and determines malware presence based on these representations, employing a hierarchical neural network model to automatically learn patterns within the file structure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If superficial analysis methods are used for malware detection, then the detection process is simple and fast, but the detection accuracy is insufficient and cannot identify evasive malware
Solution Approach 1:
The patent segments the executable file into hierarchical components: instructions are divided into instruction vectors, code is organized into control flow graphs with basic blocks, and functions are structured into call graphs. This segmentation allows deep structural analysis without overwhelming complexity, as each level can be processed independently and systematically.
Solution Approach 2:
The patent transforms the analysis from superficial file attributes to multi-dimensional structural representations by creating control flow graphs that map execution paths, call graphs that show function relationships, and instruction vectors that capture semantic meaning. This dimensional transformation enables detection of malicious patterns that are invisible at the surface level.
2Adaptability or versatility
If traditional antivirus methods relying on human expertise are used, then the implementation is straightforward, but they cannot adapt to the growing diversity and evasiveness of malware forms
Solution Approach 1:
The patent implements self-service through automated hierarchical analysis that extracts structural features and generates detection signals without human intervention. The system automatically disassembles executables, builds control flow graphs, identifies malicious patterns, and adapts to new malware forms by learning from structural anomalies, eliminating the need for continuous human expertise updates.
Solution Approach 2:
The patent changes the detection parameters from traditional antivirus signatures and heuristics to structural parameters including control flow graph metrics, call graph relationships, instruction vector patterns, and hierarchical feature representations. This parameter transformation enables the system to detect diverse malware forms based on their structural characteristics rather than relying on predefined signatures.
3Reliability
If hierarchical structural analysis is performed on executable files, then malware detection accuracy improves, but the computational complexity and processing time increase
Solution Approach 1:
The hierarchical analysis is segmented into parallel processing stages: instruction disassembly and vectorization, control flow graph construction, call graph generation, and feature extraction. Each stage can be processed independently and potentially in parallel, reducing overall analysis time while maintaining comprehensive structural examination for high detection reliability.
Solution Approach 2:
The patent performs preliminary actions by pre-processing the executable into standardized representation formats (instruction vectors, control flow graphs, call graphs) that capture essential structural information. These pre-computed representations enable faster subsequent analysis and pattern matching, reducing the time required for actual malware detection while ensuring reliable results.
Data Source
AI summary
In one embodiment, a device disassembles an executable file into assembly instructions. The device maps each of the assembly instructions to a fixed length instruction vector using one-hot encoding and an instruction vocabulary and forms vector representations of blocks of a control flow graph for corresponding functions of the executable file by embedding and aggregating bags of the instruction vectors. The device generates, based on the vector representations of the blocks of the control flow graph, a call graph model of the functions in the executable file. The device forms a vector representation of the executable file based in part on the call graph model. The device determines, based on the vector representation of the executable file, whether the executable file is malware.