Malware Severity Classification via Multi-Provider Aggregation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing malware detection systems face challenges in accurately classifying malware severity and maintaining a representative reference file set that reflects current threats, as threats constantly evolve and manual inspection is labor-intensive and prone to errors.

Innovation Solution

A method is developed to generate a reference file set with high-confidence malware severity classification by selecting a subset of files from recent observations, polling other antivirus providers for classifications, and adding files with changed classifications during a stabilization period to ensure representation of complex and emerging threats, thereby creating a stable 'ground truth' for testing anti-malware algorithms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual inspection is used to classify malware severity, then classification accuracy can be maintained, but labor intensity and time consumption increase significantly

Engineering Contradiction:

Improvemalware severity classification accuracyVSAvoidtime consumption for classification

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary automated classification of files using multiple antivirus providers before finalizing the reference file set. This preliminary action filters and pre-categorizes files, reducing the need for manual inspection while maintaining high accuracy through subsequent validation steps.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where classification results are continuously validated and refined. Multiple antivirus providers' classifications are aggregated and compared, with feedback loops that adjust and improve classification accuracy over time, reducing reliance on manual inspection.

Inventive Principle:

Principle #23Feedback

2Adaptability or versatility

If a reference file set is updated frequently to reflect current threats, then representativeness improves, but stability and reliability decrease

Engineering Contradiction:

Improverepresentativeness of current threatsVSAvoidstability of reference file set

Core Design Contradiction:

Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

The reference file set is designed to be dynamic rather than static. Files are continuously added and removed based on threat intelligence from multiple antivirus providers, allowing the set to adapt to current threats while maintaining stability through systematic update procedures and validation processes.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes parameters such as file inclusion criteria, classification thresholds, and provider weighting based on observed threat patterns. These parameter adjustments allow the reference file set to remain representative of current threats while maintaining structural stability through controlled modification.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If multiple antivirus providers are polled for classification, then classification reliability improves, but system complexity and processing time increase

Engineering Contradiction:

Improveclassification reliabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system merges classifications from multiple antivirus providers into a unified reference file set. By combining multiple sources of classification data and aggregating results, the system achieves higher reliability while managing complexity through integrated processing and standardized evaluation procedures.

Inventive Principle:

Principle #5Merging (Combining)

4Measurement precision

If files with changed classifications are added during stabilization period, then completeness of threat representation improves, but false positive rate may increase

Engineering Contradiction:

Improvecompleteness of threat representationVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

Files with changed classifications undergo preliminary validation and stabilization period monitoring before being added to the reference file set. This preliminary action allows the system to verify classification changes and reduce false positives while ensuring complete threat representation through careful selection criteria.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11861006B2High-confidence malware severity classification of reference file set

Publication Date: 2024.01.02 GEN DIGITAL INC

AI summary

A reference file set having high-confidence malware severity classification is generated by selecting a subset of files from a group of files first observed during a recent observation period and including them in the subset. A plurality of other antivirus providers are polled for their third-party classification of the files in the subset and for their third-party classification of a plurality of files from the group of files not in the subset. A malware severity classification is determined for the files in the subset by aggregating the polled classifications from the other antivirus providers for the files in the subset after a stabilization period of time, and one or more files having a third-party classification from at least one of the polled other antivirus providers that changed during the stabilization period to the subset are added to the subset.