Malware Detection via URI Behavioral Vectorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying malicious software (malware) is challenging due to its evolving methods of installation and evasion techniques, such as changing application names and domain names, which make it difficult for traditional whitelisting methods to detect.
Innovation Solution
A method using data processing hardware to receive and execute a software application, identify the uniform resource identifiers (URIs) it interacts with, and generate a vector representation using a feed-forward neural network. This representation is then used to determine similarity scores with a pool of training applications, flagging the software as potentially harmful if similarity thresholds are met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional whitelisting methods are used to identify malware, then known applications and domain names can be blocked, but malware authors can easily evade detection by changing application names and domain names
Solution Approach 1:
The patent transforms the detection approach from using static string parameters (application names, domain names) to using dynamic behavioral parameters (URIs interacted with during execution). This parameter transformation allows the system to detect malware based on its operational characteristics rather than its identity, making evasion through renaming ineffective.
Solution Approach 2:
The system performs preliminary execution of the application in a controlled environment before deployment to extract behavioral characteristics and URIs. This preliminary action creates a fingerprint of the application's behavior that can be used for detection without requiring knowledge of the application's final name or identity.
2Reliability
If manual whitelisting of known malicious applications is performed, then detection of identified malware is possible, but continuous updates and human effort are required to maintain effectiveness
Solution Approach 1:
The system automatically executes applications to extract their behavioral characteristics and URIs, then uses machine learning models to identify malicious patterns. This self-service approach eliminates the need for manual analysis and continuous human updates, as the system autonomously learns from new applications and updates its detection capabilities.
Solution Approach 2:
The system implements a feedback loop where detected malicious applications and their behavioral patterns are fed back into the training dataset for the machine learning model. This continuous feedback mechanism allows the system to improve its detection accuracy over time without requiring external manual intervention.
3Measurement precision
If behavioral analysis through execution is performed to identify malware, then detection accuracy improves, but the complexity of the identification system increases
Solution Approach 1:
The patent introduces a controlled execution environment as an intermediary between the malware sample and the analysis system. This intermediary automatically captures behavioral data and URIs, transforming complex malware behavior into structured data that can be processed by the machine learning model, thereby managing complexity through automation.
Solution Approach 2:
The system creates a copy of the application's behavioral characteristics and URI interactions rather than analyzing the original application directly. This copying approach allows multiple analyses to be performed on the same behavioral data without risking the original system, and enables efficient comparison against the training dataset.
Data Source
AI summary
A method for identifying malicious software includes receiving and executing a software application, identifying a plurality of uniform resource identifiers the software application interacts with during execution of the software application, and generating a vector representation for the software application using a feed-forward neural network configured to receive the plurality of uniform resource identifiers as feature inputs. The method also includes determining similarity scores for a pool of training applications, each similarity score associated with a corresponding training application and indicating a level of similarity between the vector representation for the software application and a respective vector representation for the corresponding training application. The method also includes flagging the software application as belonging to a potentially harmful application category when one or more of the training applications have similarity scores that satisfy a similarity threshold and include a potentially harmful application label.