Malware Detection via Static Dynamic Feature Fusion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection tools face limitations as they rely on either static or dynamic analysis, lacking comprehensive detection capabilities, especially in augmenting the depth of behavior analysis with static analysis.
Innovation Solution
Integrating metadata from static analyzers with behavioral tools during behavior analysis, using machine-learning models for both static and dynamic features to classify unknown files, and processing verdicts from both analyses to enhance malware detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If only dynamic analysis is used for malware detection, then runtime behavior can be detected, but the detection lacks the depth and accuracy of static analysis
Solution Approach 1:
The patent combines static analysis and dynamic analysis into a unified malware detection system. The static analysis component extracts metadata and structural features from malware samples, while the dynamic analysis component monitors runtime behavior. Both analysis results are integrated through a machine learning classifier that processes features from both sources to produce a comprehensive detection verdict, thereby achieving both depth (from static analysis) and runtime detection capability (from dynamic analysis)
2Measurement precision
If multiple machine-learning models are used for classification, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the malware detection system into multiple specialized machine-learning models, each trained on specific feature sets from different analysis components (static analysis, dynamic analysis). Each model focuses on particular aspects of malware detection, and their results are integrated through an ensemble classification approach. This segmentation allows each model to achieve high accuracy in its specific domain while the overall system benefits from diversified detection capabilities
Data Source
AI summary
A system and method for malware detection uses static and dynamic analysis to train a machine learning model. At the training step, static and dynamic features are extracted from training datasets and used to train a malware classification model. The malware classification model is used to classify unknown files based on verdicts from both static and dynamic models.