Malware Training Data Generation Using Function Block Decomposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The lack of training data for machine learning models to detect malware in open-source software, due to the removal of malicious software from repositories and the reluctance of sharing sensitive content, hinders effective detection techniques.
Innovation Solution
Artificially generate malware benchmarks by decomposing attack vectors and good software samples into function blocks, supplementing the good software with malicious function blocks to create adapted training data for machine learning models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If real malware samples are used for training machine learning models, then the detection accuracy is improved, but the availability of training data deteriorates due to removal from repositories and reluctance to share sensitive content
Solution Approach 1:
The patent creates synthetic copies of malware by decomposing real malware into function blocks and recombining them with good software. This generates training data that mimics real malware characteristics without requiring access to actual malware samples, thus resolving the contradiction between needing accurate training data and the unavailability of real malware samples
Solution Approach 2:
The patent segments malware into discrete function blocks that represent specific malicious operations. This segmentation allows the malware to be reconstructed in various combinations with good software, creating diverse training samples without needing to obtain additional real malware samples
2Reliability
If machine learning models are trained to detect malware, then the security of technical systems is improved, but the complexity of the detection system increases
Solution Approach 1:
The detection system is simplified by segmenting malware into standardized function blocks. Instead of analyzing entire malware samples or complex code patterns, the system detects specific function blocks that represent malicious operations, reducing the overall complexity of the detection system while maintaining high security
Solution Approach 2:
The patent applies local quality by focusing detection efforts on specific critical function blocks rather than analyzing the entire software sample uniformly. This allows the system to achieve high security by detecting localized malicious patterns without requiring complex analysis of all code
Data Source
AI summary
A method for generating training data for use in training a machine learning model used to detect malware, in particular in operating software for a technical system. The method includes: providing malware data, which include a plurality of decompositions, wherein each decomposition comprises function blocks that are or have been obtained by decomposing an attack vector; providing good software data, which comprise a plurality of decompositions, wherein each decomposition comprises function blocks that are or have been obtained by decomposing a good software sample; generating the training data, on the basis of the malware data and the good software data, wherein the training data comprise adapted good software samples, which are each based on function blocks of a corresponding good software sample that are supplemented with one or more function blocks of the malware data; and providing the training data for use in training the machine learning model.