Malware Labeling Apparatus Using Feature Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware labeling techniques, such as AVCLASS, fail to provide labels when no label candidates are generated, and random character strings can lead to inaccurate labeling.
Innovation Solution
A labeling apparatus that extracts features of malware and compares them with a known malware group to identify the most similar malware, assigning the corresponding label to the unknown malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If label candidates are generated using multiple antivirus companies, then labeling coverage is improved, but labeling accuracy deteriorates when random character strings are included
Solution Approach 1:
The patent changes the parameter of label selection from random selection or antivirus-generated candidates to selection based on similarity degree calculation. By calculating the similarity degree between malware samples and selecting labels from samples with high similarity, the system improves labeling accuracy while maintaining coverage.
Solution Approach 2:
The patent replaces the mechanical system of antivirus-based label generation with a similarity-based labeling system. Instead of relying on antivirus detection results, the system uses feature extraction and similarity calculation to determine labels, thereby eliminating random character strings and improving accuracy.
2Extent of automation
If antivirus-based label generation is used, then labeling process is automated, but labeling fails when no label candidates are generated
Solution Approach 1:
The patent performs preliminary action by pre-calculating and storing similarity degrees between malware samples. When a sample needs labeling, the system can quickly retrieve pre-computed similarity information and assign labels based on the most similar labeled samples, ensuring reliable labeling even when antivirus generates no candidates.
Solution Approach 2:
The patent introduces similarity degree calculation as an intermediary mechanism between malware samples and labels. This intermediary allows the system to transfer labels from similar samples to unlabeled samples, ensuring reliable labeling without depending on antivirus-generated candidates.
3Measurement precision
If feature extraction and similarity comparison is performed, then labeling accuracy is improved, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing feature vectors and similarity degrees for malware samples. This allows the system to perform fast label assignment by simply comparing pre-computed similarity values, rather than performing full feature extraction and comparison during labeling operations.
Solution Approach 2:
The patent extracts and stores essential features (feature vectors) of malware samples in advance. By separating feature extraction from the labeling process and storing extracted features for future use, the system reduces processing time during actual labeling operations while maintaining accuracy.
Data Source
AI summary
A labeling apparatus includes processing circuitry configured to extract a feature of malware to be labeled and features of a malware group with a known label, and identify malware or a malware group with a feature among the features of the malware group that is most similar to the feature of the malware to be labeled based on a degree of similarity between the feature of the malware to be labeled and each of the features of the malware group extracted, and give a label that has been given to the malware or the malware group to the malware to be labeled.