Malware Sequence Detection via Subsequence Learning

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Malware detection in computing systems is challenging due to its ability to exploit code vulnerabilities, operate in noncontinuous sequences, and hide within complex event sequences, making it difficult to detect using traditional methods.

Innovation Solution

A malware sequence detection system that analyzes sequences of events by dividing them into subsequences, performing sequential subsequence learning, and using pre-informant learning (PIL) to generate a probability of malware presence, with features like sigmoid operations, convolutional neural networks, and long-short term memory (LSTM) models to identify malicious patterns.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional malware detection methods are used, then the detection process is simple, but the detection precision is low and malware sequences are not easily detected

Engineering Contradiction:
Improvemalware detection precisionVSAvoiddetection system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent divides the event sequence into multiple subsequences and processes them separately through sequential subsequence learning. This segmentation allows the system to handle complex malware patterns by breaking them into manageable chunks, improving detection precision without requiring a monolithic complex system

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary action by dividing sequences into subsequences and performing sequential subsequence learning before final classification. The PIL process also performs preliminary filtering by comparing sigmoid outputs to thresholds early in the process, eliminating obviously malicious sequences before more complex analysis

Inventive Principle:
Principle #10Preliminary action

2Productivity

If the entire sequence of events is analyzed at once, then the detection is straightforward, but the processing time increases and efficiency decreases

Engineering Contradiction:
Improvemalware detection efficiencyVSAvoidprocessing time
Core Design Contradiction:
ProductivityVSLoss of time

Solution Approach 1:

The patent segments the event sequence into multiple subsequences that can be processed in parallel or sequentially with smaller computational overhead. This reduces the time complexity compared to analyzing the entire sequence at once while maintaining detection accuracy

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The PIL process enables skipping further processing of obviously malicious subsequences by comparing sigmoid outputs to thresholds and terminating early when malware is detected. This rushing through of clearly malicious cases significantly improves processing efficiency for high-risk sequences

Inventive Principle:
Principle #21Skipping (Rushing through)

3Measurement precision

If malware sequences are divided into subsequences, then the detection accuracy improves, but the device complexity increases

Engineering Contradiction:
Improvemalware sequence detection accuracyVSAvoidprocessing system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing malware sequences into subsequences and applying sequential subsequence learning to each. This improves detection accuracy by capturing local patterns that might be missed in global analysis, while the modular structure manages complexity

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The PIL process acts as an intermediary between sequential subsequence learning and final classification. It performs intermediate filtering and preprocessing, managing the complexity between the detailed subsequence analysis and the overall detection decision

Inventive Principle:
Principle #24Intermediary (Mediator)

4Productivity

If pre-informant learning is implemented with early termination, then the processing efficiency improves, but the risk of false negatives increases

Engineering Contradiction:
Improveprocessing efficiencyVSAvoiddetection reliability
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The PIL process performs preliminary action by evaluating subsequences early through sigmoid operations and threshold comparisons. This enables early termination for clearly malicious cases, improving efficiency while the preliminary nature allows for corrective action if needed

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system implements feedback by generating notifications to receivers when malware is detected through the PIL process. This feedback mechanism allows for verification and correction of early termination decisions, maintaining reliability while benefiting from efficiency gains

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP3729315B1Malware sequence detection
Publication Date: 2024.08.28 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3729315B1 patent drawingFigure 1
  • EP3729315B1 patent drawingFigure 2
  • EP3729315B1 patent drawingFigure 3

AI summary

Implementations described herein disclose a malware sequence detection system for detecting presence of malware in a plurality of events. An implementation of the malware sequence detection includes receiving a sequence of a plurality of events, and detecting presence of a sequence of malware commands within the sequence of a plurality of events by dividing the sequence of plurality of events into a plurality of subsequences, performing sequential subsequence learning on one or more of the plurality of subsequences, and generating a probability of one or more of the plurality of subsequences being a malware based on the output of the sequential subsequence.