Malware Rule Generation with Abstraction Levels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for automatically generating rules to detect malware traces are not accurate enough, often resulting in false positives due to the inability to differentiate between normal program or user activity and malware traces.
Innovation Solution
A rule generation apparatus that processes malware analysis results to enumerate rule candidates with varying degrees of abstraction, calculates evaluation values using a predetermined function, and sorts rules based on these values to enhance detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automatic rule generation methods using network signatures are applied to generate IOCs, then rule generation efficiency is improved, but detection accuracy deteriorates due to false positives from normal program or user activity being matched
Solution Approach 1:
The patent applies dynamics by making the rule abstraction level adjustable and adaptive. The system dynamically selects between high-level abstract rules (for efficiency) and low-level concrete rules (for accuracy) based on the detection context, allowing the rule structure to adapt to different operational requirements and reduce false positives while maintaining generation efficiency.
Solution Approach 2:
The patent changes the parameter of rule abstraction level from fixed to variable. By introducing multiple abstraction levels (high-level and low-level) and allowing dynamic switching between them, the system can adjust the specificity of rules to balance detection efficiency and accuracy, preventing normal activity from being incorrectly flagged while maintaining high-level pattern recognition capabilities.
2Device complexity
If rules with single degree of abstraction are used for malware trace detection, then rule simplicity is improved, but detection reliability deteriorates due to inability to differentiate malware from normal activity
Solution Approach 1:
The patent segments the rule structure into multiple abstraction levels. High-level rules capture general malware behavior patterns with broad coverage, while low-level rules provide specific detailed patterns for precise identification. This segmentation allows the system to use simple high-level rules for initial filtering and more complex low-level rules for confirmation, improving reliability without requiring all rules to be equally complex.
Solution Approach 2:
The patent adds a new dimension to the rule structure by introducing abstraction level as a vertical layer. Instead of using single-dimension simple rules, the system creates a multi-layered rule structure where high-level abstract rules operate in one dimension and low-level concrete rules operate in another, allowing detection to proceed from general to specific and improve reliability through hierarchical validation.
Data Source
AI summary
A rule generation apparatus includes processing circuitry configured to enumerate rule candidates with different degrees of abstraction as candidates for a rule for detecting a malware trace using an analysis result of malware, and calculate evaluation values of the rule candidates enumerated using a predetermined evaluation function and sort a rule from among the rule candidates based on the evaluation values.