Malware Detection via Opcode Image Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods are limited in detecting new or unknown malware variants due to accuracy and performance limitations, particularly in signature-based detection and static/dynamic analysis techniques.
Innovation Solution
A method utilizing AI-based deep-learning models to detect unknown malware by generating multi-pixel images from operation code (opcode) information, which includes feature engineering and training data incorporating entropy, creation dates, and distribution information, allowing for classification and detection of variable-length feature information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature-based detection is used, then detection speed is improved, but detection accuracy for unknown malware deteriorates
Solution Approach 1:
The patent replaces traditional signature-based mechanical detection with AI-based deep learning models that analyze opcode sequences. The system converts malware opcodes into multi-pixel images and uses convolutional neural networks to detect patterns, substituting rule-based matching with intelligent pattern recognition that achieves both speed and accuracy for unknown malware variants.
Solution Approach 2:
The patent transforms the detection parameters by converting opcode sequences into multi-pixel image representations. This parameter transformation enables the use of image processing techniques and deep learning models that can identify malware patterns based on structural features rather than fixed signatures, improving detection of unknown variants while maintaining efficiency.
2Measurement precision
If static or dynamic analysis techniques are used, then detection capability for unknown malware is improved, but processing time and complexity increase
Solution Approach 1:
The patent extracts only the essential opcode sequences from malware binaries, converting them into compact multi-pixel image representations. This extraction of key features eliminates the need for complete static or dynamic analysis, reducing processing time while maintaining detection capability for unknown malware variants.
Solution Approach 2:
The patent creates simplified copies of malware behavior through multi-pixel image representations of opcode sequences. These image copies capture the essential characteristics of malware execution patterns without requiring actual malware execution, enabling fast analysis that avoids the time-consuming nature of dynamic analysis while preserving detection accuracy.
3Measurement precision
If feature information with variable length is used, then detection accuracy for diverse malware is improved, but processing complexity increases
Solution Approach 1:
The patent resolves variable-length processing complexity by transforming opcode sequences into two-dimensional multi-pixel images. This dimensional transformation allows fixed-size image processing operations to handle variable-length input sequences, maintaining detection accuracy for diverse malware while simplifying the processing architecture through standardized image manipulation operations.
Data Source
AI summary
Disclosed herein are an apparatus for detecting unknown malware using a variable-length operation code (opcode) and a method using the apparatus. The method includes collecting opcode information from a detection target, generating a multi-pixel image having a variable length by performing feature engineering on the opcode information; and detecting unknown malware by inputting the multi-pixel image to a deep-learning model based on AI.