Malware Sequence Detection via Subsequence Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware detection in computing systems is challenging due to its ability to exploit code vulnerabilities, operate in noncontinuous sequences, and hide within complex event sequences, making it difficult to detect using traditional methods.
Innovation Solution
A malware sequence detection system that analyzes sequences of events by dividing them into subsequences, performing sequential subsequence learning, and using pre-informant learning (PIL) to generate a probability of malware presence, with features like sigmoid operations, convolutional neural networks, and long-short term memory (LSTM) models to identify malicious patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then the detection process is simple, but the detection precision is low and malware sequences are not easily detected
Solution Approach 1:
The patent divides the event sequence into multiple subsequences and processes them separately through sequential subsequence learning. This segmentation allows the system to handle complex malware patterns by breaking them into manageable chunks, improving detection precision without requiring a monolithic complex system
Solution Approach 2:
The patent performs preliminary action by dividing sequences into subsequences and performing sequential subsequence learning before final classification. The PIL process also performs preliminary filtering by comparing sigmoid outputs to thresholds early in the process, eliminating obviously malicious sequences before more complex analysis
2Productivity
If the entire sequence of events is analyzed at once, then the detection is straightforward, but the processing time increases and efficiency decreases
Solution Approach 1:
The patent segments the event sequence into multiple subsequences that can be processed in parallel or sequentially with smaller computational overhead. This reduces the time complexity compared to analyzing the entire sequence at once while maintaining detection accuracy
Solution Approach 2:
The PIL process enables skipping further processing of obviously malicious subsequences by comparing sigmoid outputs to thresholds and terminating early when malware is detected. This rushing through of clearly malicious cases significantly improves processing efficiency for high-risk sequences
3Measurement precision
If malware sequences are divided into subsequences, then the detection accuracy improves, but the device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing malware sequences into subsequences and applying sequential subsequence learning to each. This improves detection accuracy by capturing local patterns that might be missed in global analysis, while the modular structure manages complexity
Solution Approach 2:
The PIL process acts as an intermediary between sequential subsequence learning and final classification. It performs intermediate filtering and preprocessing, managing the complexity between the detailed subsequence analysis and the overall detection decision
4Productivity
If pre-informant learning is implemented with early termination, then the processing efficiency improves, but the risk of false negatives increases
Solution Approach 1:
The PIL process performs preliminary action by evaluating subsequences early through sigmoid operations and threshold comparisons. This enables early termination for clearly malicious cases, improving efficiency while the preliminary nature allows for corrective action if needed
Solution Approach 2:
The system implements feedback by generating notifications to receivers when malware is detected through the PIL process. This feedback mechanism allows for verification and correction of early termination decisions, maintaining reliability while benefiting from efficiency gains
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Implementations described herein disclose a malware sequence detection system for detecting presence of malware in a plurality of events. An implementation of the malware sequence detection includes receiving a sequence of a plurality of events, and detecting presence of a sequence of malware commands within the sequence of a plurality of events by dividing the sequence of plurality of events into a plurality of subsequences, performing sequential subsequence learning on one or more of the plurality of subsequences, and generating a probability of one or more of the plurality of subsequences being a malware based on the output of the sequential subsequence.