Malware Label Inference in Large Multigraphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying and visualizing malware in large multigraphs is challenging due to the complexity of polymorphic viruses and the vast number of files and events involved, making conventional analysis impractical in terms of resources and time.
Innovation Solution
A system that creates a multigraph database from behavior logs, using a malware label inference engine and visualizer to analyze nodes and edges, employing a specificity index to score nodes for malware likelihood and visualize the graph, allowing for efficient identification of malicious nodes and paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional analysis methods are used to analyze malware chains, then analysis accuracy may be maintained, but the time and computational resources required become impractical due to the large number of files and events involved
Solution Approach 1:
The patent segments the large multigraph into smaller subgraphs based on connectivity thresholds and malware label propagation. By dividing the analysis into manageable subgraphs rather than processing the entire graph at once, the system achieves practical analysis speed while maintaining accuracy through localized processing.
Solution Approach 2:
The patent applies local quality by using connectivity thresholds to identify and focus analysis on specific regions of the multigraph that have meaningful relationships. Nodes and edges below certain connectivity thresholds are excluded from subgraph formation, allowing the system to concentrate computational resources on locally relevant areas rather than uniformly processing the entire graph.
2Loss of information
If the entire multigraph is visualized, then complete malware chain information is provided, but the visualization becomes unreadable and unusable due to the vast number of nodes and edges
Solution Approach 1:
The patent segments the large multigraph into multiple smaller subgraphs that can be individually visualized and explored. Each subgraph represents a connected component or region of interest, making visualization manageable while preserving the complete malware chain information across multiple viewable units.
Solution Approach 2:
The patent introduces an additional dimension of exploration by allowing users to navigate between subgraphs and drill down into specific regions. This dimensional approach to visualization enables complete information access through hierarchical or spatial navigation rather than displaying all elements simultaneously in a single flat view.
3Reliability
If all nodes and edges are included in analysis, then comprehensive malware detection is achieved, but the computational resources and time required become impractical
Solution Approach 1:
The patent applies local quality by setting connectivity thresholds that filter out sparsely connected nodes and edges from subgraph formation. This selective inclusion ensures that only locally significant relationships are analyzed in detail, maintaining detection accuracy for meaningful malware chains while excluding computationally expensive analysis of irrelevant connections.
Solution Approach 2:
The patent employs partial action by analyzing only the necessary subset of the multigraph that meets connectivity criteria rather than processing every node and edge. This selective approach achieves sufficient detection accuracy for practical purposes while significantly reducing the time and resources required compared to exhaustive analysis.
Data Source
AI summary
Analyzing a large number of files to identify malicious software including evaluating a multigraph including determining a graph having a plurality of nodes, including a source node and target nodes from a data set and merging the graph into a multigraph in response to a node score above a threshold level, for each target node; determining one or more specificity indexes for target node and determining a node score for the target node based, at least in part, on a specificity index.