Malware Scanner Selection Using AI-Generated Mutated Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware scanners struggle to detect malicious code in software packages due to polymorphic and metamorphic variations, making it difficult to identify and prevent the distribution of infected software.
Innovation Solution
A system using artificial intelligence (AI) generates mutated malware to test malware scanners by mimicking how malicious actors obfuscate code, iteratively mutating malware to create variants that are difficult to detect, and ranks and deploys the most effective scanners based on their detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware scanners use traditional signature-based detection methods, then they can identify known malware patterns, but they fail to detect polymorphic and metamorphic malware that use varying signatures and structures
Solution Approach 1:
The patent changes the detection parameters from static signatures to dynamic behavior patterns. The system analyzes malware through multiple transformation stages (polymorphic and metamorphic variations) and evaluates detection effectiveness across these parameter changes, enabling scanners to identify malware regardless of signature variation.
Solution Approach 2:
The patent implements a feedback mechanism where mutated malware variants are systematically generated and tested against scanners. The detection results from these tests feed back into the system to rank and select effective scanners, continuously improving detection capability through iterative evaluation.
2Measurement precision
If the malicious package includes a mix of malicious code and benign code, then the amount of benign code may exceed the amount of malicious code, making detection more difficult
Solution Approach 1:
The patent segments the malware analysis into distinct components: identifying malicious code segments, isolating benign code segments, and analyzing their interactions. This segmentation allows the system to focus detection efforts on suspicious segments while filtering out benign code, reducing overall analysis complexity.
Solution Approach 2:
The patent extracts and isolates the malicious components from the mixed codebase. By separating malicious code segments from benign code, the system can apply targeted detection methods to the extracted malicious portions, improving detection precision without being overwhelmed by the volume of benign code.
3Measurement precision
If multiple malware scanners are deployed to improve detection coverage, then detection capability increases, but system complexity and resource requirements increase
Solution Approach 1:
The patent creates a universal evaluation framework that can assess multiple scanners using the same set of mutated malware variants. This standardized approach allows comprehensive comparison of different scanners without requiring separate evaluation systems for each scanner type, reducing overall system complexity.
Solution Approach 2:
The patent uses copies of mutated malware variants as test samples to evaluate multiple scanners. By creating a standardized set of test cases through copying and transformation, the system can efficiently compare scanner performance across different detection methods without replicating entire evaluation infrastructure for each scanner.
Data Source
AI summary
In some cases, malicious code is injected into a legitimate software package to create an injected package. An AI extracts a plurality of parts of the injected package, mutates individual parts to create multiple mutated parts, and assembles at least a portion of them to create a mutated malware. A malware scanner determines a risk score associated with the mutated malware. If the risk score satisfies a predetermined threshold, the mutated malware is stored in a set of mutated malware. When a number of mutated malware in the set of mutated malware satisfies a requested number, a plurality of malware scanners are ranked based on their ability to identify malware from the set of mutated malware. Based at least in part on the ranking, a particular malware scanner that identified a maximum number of malware from the set of mutated malware is selected and deployed to detect malware.