Markov Model File Classification for Unknown Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file classification systems are unable to accurately predict and classify all files as malicious or clean, as they rely on known patterns and struggle with unknown or evolving malware.
Innovation Solution
A machine learning-based classification system using Markov modeling generates representations of file sections as sequences of characters, determining conditional probabilities for transitions between sections, and classifies files based on these probabilities to identify malicious or clean files, preventing execution of malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file classification systems are used to detect malicious software, then known malicious files can be detected and prevented, but the system cannot accurately classify all files including unknown or evolving malware
Solution Approach 1:
The patent transforms the file analysis approach by changing parameters from static signature matching to dynamic sequence probability analysis. Files are represented as sequences of sections with conditional probabilities calculated for transitions between sections, allowing the system to detect both known and unknown malware based on structural patterns rather than fixed signatures
Solution Approach 2:
The patent replaces traditional mechanical pattern-matching classification systems with a probabilistic Markov modeling system. Instead of relying on predetermined signatures, the system uses conditional probabilities to model the sequential structure of files, enabling detection of malicious patterns in both known and evolving malware types
2Measurement precision
If file classification systems rely on known patterns, then classification of known malicious files is effective, but the system fails to predict and classify unknown or evolving malware
Solution Approach 1:
The patent performs preliminary action by pre-calculating conditional probabilities for all possible section transitions from training files during an offline phase. These pre-computed probabilities are stored in a model that can quickly evaluate new files without requiring real-time pattern matching, enabling fast and accurate detection of both known and unknown malware
Solution Approach 2:
The patent creates a probabilistic model copy of the training files' structural patterns. Instead of storing actual file signatures, the system copies the sequential relationship patterns into a Markov model that can generate and compare probability sequences, allowing detection of files that follow malicious patterns even if their exact content is unknown
Data Source
AI summary
Systems, methods, and articles of manufacture, including computer program products, are provided for classification systems and methods using modeling. In some example embodiments, there is provided a system that includes at least one processor and at least one memory including program code which when executed by the at least one memory provides operations. The operations can include generating a representation of a sequence of sections of a file and/or determining, from a model including conditional probabilities, a probability for each transition between at least two sequential sections in the representation. The operations can further include classifying the file based on the probabilities for each transition.