Malicious Software Recognition via Network Flow Dataset Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security equipment struggles to accurately recognize malicious software categories due to similar network behaviors and continuous variations, segmentation, or re-packaging, especially when network communication is encrypted, limiting its ability to determine whether a software program is normal or malicious.
Innovation Solution
A malicious software recognition apparatus and method that uses a processor and storage to analyze network flow datasets, combining and integrating subsets with high overlap to update the training dataset and re-train a recognition model using machine learning, enhancing recognition accuracy and adaptability to new threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network security equipment determines whether a software program is normal or malicious only based on network behaviors, then the equipment can operate without system behavior data, but the recognition accuracy is low due to similar network behaviors and continuous variation of malicious software
Solution Approach 1:
The patent combines multiple data sources (network behaviors, system behaviors, and file information) into a comprehensive analysis framework. The malicious software recognition apparatus integrates data from hooks, system calls, and file systems to create a multi-dimensional recognition model that overcomes the limitations of single-source analysis.
2Reliability
If the network communication of a software program is encrypted, then the communication security is improved, but the network security equipment cannot recognize the software program because the advanced packet feature cannot be obtained
Solution Approach 1:
The patent segments the recognition process into multiple independent components: network behavior analysis, system behavior analysis, and file information analysis. This segmentation allows the system to bypass encrypted network traffic by analyzing other dimensions (system calls, file operations) that are not affected by encryption.
Solution Approach 2:
The patent introduces system behaviors and file information as intermediary data sources that bridge the gap when network behavior analysis fails due to encryption. These intermediaries provide alternative pathways for recognition without requiring decryption of network traffic.
3Adaptability or versatility
If the malicious software recognition model uses multiple malicious software categories, then the coverage of threat detection is improved, but the recognition accuracy decreases due to high overlap degree of network flow datasets
Solution Approach 1:
The patent transitions from single-dimension network behavior analysis to multi-dimensional analysis by incorporating system behaviors and file information. This dimensional expansion provides additional discriminative features that help distinguish between overlapping malicious software categories.
Solution Approach 2:
The patent changes the parameters used for recognition from purely network-based features to a composite set including system call parameters, file operation parameters, and behavioral parameters. This parameter transformation enables better differentiation between similar malicious software types.
4Reliability
If the network security equipment analyzes and records network behaviors of various malicious software programs, then the detection capability is improved, but the loss of time increases due to continuous updates and analysis requirements
Solution Approach 1:
The patent performs preliminary analysis by collecting and preprocessing data from multiple sources simultaneously during normal operation. The system prepares recognition models in advance using historical data, so when new malicious software is detected, the analysis can be performed more quickly without extensive real-time processing.
Data Source
AI summary
A malicious software recognition apparatus and method are provided. The malicious software recognition apparatus stores a training dataset, which includes a plurality of network flow datasets. Each network flow dataset corresponds to one of a plurality of software categories, and the software categories include a plurality of malicious software categories. The malicious software recognition apparatus tests a malicious software recognition model and learns that a plurality of recognition accuracies of a subset of the malicious software categories are low, determines that an overlap degree of the network flow datasets corresponding to the subset is high, updates the software categories by combining the malicious software categories corresponding to the subset, updates the training dataset by integrating the network flow datasets corresponding to the subset, trains the malicious software recognition model according to the updated training dataset. The trained malicious software recognition model is deployed to the real world.