Malware Rule Generation via Negative Feedback Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems face challenges in timely detection and adaptation to new malware threats due to the vast number of new files created daily and the complexity of distinguishing malicious files in high-dimensional feature spaces.
Innovation Solution
A system for automatically generating rules that describe malicious files using a rule generator, which processes fingerprints of files through clustering, proto-rule creation, simplification, and negative feedback scoring to produce well-formed, generic rules that minimize false positives and efficiently detect malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional malware detection methods are used to analyze millions of new files daily, then detection coverage is maintained, but the system cannot adapt timely to new malware threats and generates excessive false positives
Solution Approach 1:
The patent segments the high-dimensional feature space into multiple clusters, where each cluster represents a group of similar files. This segmentation allows the system to process and adapt to new malware threats more efficiently by working with clustered representations rather than individual files, thereby improving adaptation speed while reducing the time loss associated with analyzing millions of files daily
Solution Approach 2:
The patent implements a feedback mechanism where detection results and new malware samples are fed back into the rule generation system. This continuous feedback loop enables the system to learn from new threats and update its detection rules dynamically, significantly improving adaptability to emerging malware while maintaining timely response through iterative refinement
2Measurement precision
If complex rules are created in high-dimensional feature space to accurately detect malware, then detection precision improves, but computational resources and system complexity increase significantly
Solution Approach 1:
The patent extracts essential features and patterns from the high-dimensional feature space by creating simplified detection rules based on clustered file characteristics. Instead of processing all dimensional features for every file, the system extracts key discriminative features that define malware clusters, thereby maintaining high detection precision while reducing system complexity
Solution Approach 2:
The patent transforms the detection problem by changing parameters from individual file feature analysis to cluster-based rule evaluation. By modifying the detection parameters to work with clustered representations and simplified rules rather than raw high-dimensional features, the system achieves accurate malware detection with reduced computational complexity
3Reliability
If comprehensive analysis of all file features is performed to reduce false positives, then detection accuracy improves, but processing speed and productivity decrease
Solution Approach 1:
The patent performs preliminary clustering and rule generation actions before actual malware detection. By pre-processing files into clusters and generating detection rules in advance, the system establishes a framework that reduces false positives without requiring comprehensive analysis of every file feature during runtime, thereby maintaining high reliability while preserving processing speed
Solution Approach 2:
The patent applies partial analysis by focusing on key discriminative features and cluster characteristics rather than analyzing all file features comprehensively. This partial action approach maintains sufficient detection accuracy to reduce false positives while significantly improving processing speed by avoiding unnecessary analysis of non-critical features
Data Source
AI summary
Systems and methods use negative feedback to create generic rules for a high dimensional sparse feature space. A system receives a set of fingerprints, where a fingerprint can be a set of features of a file. The fingerprints can be clustered according to similarity. For each cluster, a proto-rule is created that has a condition for each feature. The proto-rule is simplified using negative feedback to create a well-formed rule having a comparatively small subset of the conditions in the proto-rule that are useful in determining malware. The well-formed rule can be added to a set of rules used in a malware detection system.