Malware Detection Model Hyperparameter Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection models are often optimized for efficiency, resulting in large models that are difficult to deploy due to bandwidth restrictions and high computation costs, and traditional compression methods are not applicable to all models, such as tree-based classifiers, leading to suboptimal performance.
Innovation Solution
A system and method for constructing malware detection models by identifying candidate hyperparameter sets that optimize a tradeoff between model efficacy and size, using an objective function that rewards efficacy and penalizes size, and training the model to distinguish between malicious and clean samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If malware detection models are optimized for efficiency, then model size increases, but deployment difficulty and computation cost increase
Solution Approach 1:
The patent changes the parameter optimization approach by introducing a composite objective function that simultaneously optimizes multiple parameters (detection accuracy, false positive rate, false negative rate) rather than single-parameter optimization. This allows the model to achieve high detection efficiency while maintaining manageable size through multi-objective hyperparameter tuning
Solution Approach 2:
The patent implements dynamic model construction by creating multiple specialized detection models for different malware types (peanuts, worms, trojans, etc.) rather than using a single static large model. Each model is optimized for its specific detection task, allowing the system to deploy only the necessary models based on threat requirements, thus reducing overall deployment complexity
2Ease of operation
If model size is reduced, then deployment ease improves, but detection accuracy may deteriorate
Solution Approach 1:
The patent segments the malware detection task into multiple specialized models, each handling specific malware families or detection objectives. This segmentation allows each model to be smaller and more focused, improving deployment ease while maintaining high detection accuracy through specialized optimization for each segment's specific characteristics
Solution Approach 2:
The patent creates detection models with multi-functionality by incorporating multiple objective functions within each model (detecting various malware types, controlling false positives, controlling false negatives). This allows smaller models to achieve comprehensive detection capabilities that would otherwise require larger single-purpose models
3Device complexity
If traditional compression methods are applied, then model size decreases, but applicability is limited to certain model types
Solution Approach 1:
Instead of applying compression methods that modify model structure, the patent changes the parameters during model construction (hyperparameters like tree depth, number of estimators, feature selection) to control model size from the outset. This approach is universally applicable to any machine learning model type without requiring post-training compression techniques
4Measurement precision
If hyperparameter optimization focuses only on accuracy, then detection efficacy improves, but model size control is lost
Solution Approach 1:
The patent makes the objective function multi-functional by incorporating multiple detection goals simultaneously: primary detection accuracy, false positive control, and false negative control. This allows the hyperparameter optimization process to control model size and performance characteristics comprehensively in a single optimization framework rather than requiring separate optimization steps
Data Source
AI summary
The disclosed computer-implemented method for malware remediation may include constructing a malware detection model by (i) identifying multiple candidate hyperparameter sets, (ii) selecting, from the candidate hyperparameter sets, a set of hyperparameters for the malware detection model that optimizes a tradeoff between model efficacy and model size, and (iii) training the malware detection model on a set of training samples to distinguish between malicious samples and clean samples. After constructing the malware detection model, the disclosed computer-implemented method may also include using the constructed malware detection model to perform a security action. Various other methods, systems, and computer-readable media are also disclosed.