Malware Similarity Scoring for Unknown Variant Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in accurately detecting unknown or new variants of malicious content due to their inability to dynamically learn and weight key features, leading to lower prediction accuracy and higher error rates, while also consuming excessive computing resources.
Innovation Solution
Utilizing deep learning models, such as Siamese Neural Networks and Deep Structured Semantic Models, to learn feature weights and map unknown content in feature space, improving prediction accuracy and reducing resource consumption by sharing parameters across inputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then known malware families can be detected, but unknown or new variants cannot be detected accurately
Solution Approach 1:
The system dynamically adapts its detection parameters and feature weights based on the input sample. Instead of using fixed thresholds and static feature importance, the model learns and adjusts the significance of different features (such as URL patterns, file structures, behavioral characteristics) dynamically during the detection process, enabling it to effectively identify both known and unknown malware variants
Solution Approach 2:
The system changes its detection parameters by learning feature weights from training data. Different features are assigned different weights based on their importance for detecting specific malware types. This parameter adjustment allows the system to focus on the most relevant characteristics when evaluating unknown samples, improving detection accuracy for novel threats
2Measurement precision
If feature weighting is not used, then all features are treated equally, but prediction accuracy decreases
Solution Approach 1:
The system introduces variable parameters (weights) for different features based on their importance. During training, the model learns optimal weight values for each feature type, allowing it to emphasize critical indicators (such as suspicious URL patterns or abnormal file structures) while de-emphasizing less relevant characteristics, thereby improving prediction accuracy
Solution Approach 2:
The system performs preliminary feature weighting during the training phase before actual detection. By pre-learning the importance of different features from labeled malware samples, the system prepares an optimized feature weighting scheme that can be applied during detection, reducing the computational complexity during runtime while maintaining high accuracy
3Measurement precision
If deep learning models are trained without parameter sharing, then model accuracy improves, but computing resource consumption increases
Solution Approach 1:
The system merges parameter sets across different input samples by implementing parameter sharing in the deep learning model. Instead of learning separate parameters for each sample or feature set, the model shares weights and biases across different inputs, reducing the total number of parameters to learn and store, thereby decreasing memory usage and computational overhead while maintaining detection accuracy
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various embodiments discussed herein enable the detection of malicious content. Some embodiments do this by determining a similarity score between content, computer objects, or indications (e.g., vectors, file hashes, file signatures, code, etc.) known to be malicious and other content (e.g., unknown files) or indications based on feature weighting. Over various training stages, certain feature characteristics for each labeled malicious content or indication can be learned. For example, for a first malware family of computer objects, the most prominent feature may be a particular URL, whereas other features change considerably for different iterations of the first malware family of computer objects. Consequently, the particular URL can be weighted to determine a particular output classification corresponding to malicious behavior.