Mining Malware Detection via Multi-Model Feature Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting mining malware, particularly for binary files, are inefficient due to reliance on dynamic analysis which requires executing malware and consumes significant resources, and static methods struggle with polymorphic and variant malware.
Innovation Solution
A method and system for recognizing mining malware using a static analysis method based on multi-dimensional analysis, involving pre-processing of binary file samples, extracting effective multi-dimensional features, and constructing a recognition model integrated with multiple models using the XGBoost and LightGBM algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis method is used to detect mining malware samples, then detection accuracy can be improved by capturing actual malware behaviors, but computer resources are hugely wasted due to continuous monitoring of malware behaviors
Solution Approach 1:
The patent performs preliminary extraction of multi-dimensional features (header information, text sections, import tables, code sections, resource sections) from binary samples before actual malware execution. This preliminary action captures essential behavioral indicators without requiring continuous monitoring during runtime, thereby improving detection accuracy while reducing resource consumption during the detection phase.
Solution Approach 2:
The patent creates a simplified representation (copy) of malware behavior through extracted features such as API call sequences, control flow graphs, and string patterns. Instead of continuously monitoring actual malware execution, the system analyzes these copied behavioral signatures, which preserve detection accuracy while minimizing resource usage.
2Productivity
If static analysis method is used to detect mining malware samples, then resource consumption is reduced and detection speed is improved, but detection effectiveness is limited against polymorphic malware and malware variants
Solution Approach 1:
The patent transitions from traditional single-dimension static analysis to multi-dimensional analysis by examining five distinct dimensions of binary files: header information, text sections, import tables, code sections, and resource sections. This dimensional expansion enables the system to detect polymorphic malware and variants by identifying patterns across multiple feature spaces, thereby improving detection effectiveness while maintaining high detection speed.
3Adaptability or versatility
If dynamic analysis method is used to simulate all malware behaviors, then comprehensive detection coverage is achieved, but continuous monitoring of malware behaviors results in huge waste of computer resources
Solution Approach 1:
The patent extracts specific high-value features from binary samples, including header information, text sections, import tables, code sections, and resource sections. By taking out only the most discriminative features rather than monitoring all malware behaviors, the system achieves comprehensive detection coverage for various malware types while minimizing resource consumption through targeted analysis.
4Ease of manufacture
If feature code-based detection method or heuristic-based detection method is used, then simple and effective detection is achieved, but detection efficiency becomes low with the increase of mining malware samples due to dependence on feature library and manual analysis
Solution Approach 1:
The patent transforms the detection approach by changing parameters from manual feature coding to automated multi-dimensional feature extraction. The system automatically extracts and vectorizes features across five dimensions, converting unstructured binary data into structured feature vectors. This parameter change enables the system to efficiently handle increasing numbers of malware samples without relying on manual feature library updates, thereby improving detection efficiency while maintaining simplicity.
Data Source
AI summary
Disclosed in the present invention are a method and system for recognizing mining malicious software, and a storage medium. The method comprises the following steps: pre-processing data of different dimensions; extracting and vectorizing a text feature; on the basis of Stacking, constructing a mining malicious software recognition model integrated with multiple models; and obtaining a prediction result. The present invention relates to a method for detecting mining malicious software for a binary file, which method is rare at present. The targeting performance is great, the implementation process is simple, and the efficiency is high. In addition, in the present invention, multi-dimensional feature extraction is performed on mining software features by a plurality of angles, a method of multi-model integration is designed for features of different dimensions, and a combined mining malicious software recognition model is constructed, and the model has high recognition accuracy and a low false alarm rate.