ML Malicious Attachment Detector via Static Feature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in accurately and reliably detecting suspicious message attachments due to advanced obfuscation techniques used by malware, which can lead to transmission delays and security breaches.
Innovation Solution
A machine learning-based model is employed to recognize patterns and combinations of features in electronic documents that indicate malware, using a pre-processor for static analysis to create features without executing embedded code, thus avoiding the need for sandboxing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sandboxing is used to execute embedded code for detection, then detection accuracy is improved, but transmission delay increases
Solution Approach 1:
The system performs static analysis and feature extraction on attachments before they are transmitted or executed. By pre-processing the attachment and extracting features in advance, the system prepares detection data without waiting for sandbox execution, thereby reducing transmission delay while maintaining detection capability through the machine learning classifier.
2Ease of operation
If rule-based detection is used, then ease of operation is maintained, but adaptability to new obfuscation techniques deteriorates
Solution Approach 1:
The system replaces traditional rule-based mechanical detection with a machine learning-based classifier. The classifier is trained on features extracted from attachments and can automatically adapt to new obfuscation techniques by learning patterns from training data, eliminating the need for manual rule updates while maintaining ease of operation through automated adaptation.
3Measurement precision
If continuous rule set updates are performed, then detection precision is improved, but device complexity increases
Solution Approach 1:
The machine learning classifier performs self-updates by being retrained on new training data without requiring manual intervention or complex rule management systems. The system automatically learns new patterns and adapts to changing malware techniques, eliminating the need for continuous manual rule set updates and reducing system complexity while maintaining high detection precision.
Data Source
AI summary
A method includes receiving, from a pre-processor, an output file, the output file having been created by the pre-processor in response to input of an electronic file to the pre-processor, the electronic file being an attachment to an electronic mail message that is in-transit to a recipient computer on a network, the electronic file being a spreadsheet file, the output file containing features that are created by the pre-processor; receiving, from a machine learning-based classifier, malware classification data, the malware classification data being output by the machine learning-based classifier in response to the machine learning-based classifier determining whether the features are indicators of obfuscation, the data used to create the machine learning-based classifier including output files previously created by the pre-processor; in response to the malware classification data matching a criterion, causing the network to modify, delay, or block transmission of the electronic file to the recipient computer.