Machine Learning Malware Detection via Code Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in effectively identifying and responding to malicious software on electronic devices, which can compromise performance and data integrity, as they often rely on traditional methods that are inefficient in detecting evolving malware forms.
Innovation Solution
The implementation of a code feature extraction engine using unsupervised machine learning and clustering techniques, such as deep neural networks, to analyze program code sets by representing them as control flow graphs, determining similarities, and grouping them to identify benign or malicious software, enabling appropriate corrective actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then the system is simple to implement, but the detection effectiveness and ability to identify evolving malware forms deteriorates
Solution Approach 1:
The patent replaces traditional signature-based and rule-based detection mechanisms with machine learning-based analysis. The system uses trained models to automatically analyze program code characteristics, control flow graphs, and behavioral patterns, substituting manual detection rules with adaptive computational intelligence that improves reliability against evolving malware while managing complexity through automated training pipelines.
Solution Approach 2:
The system transforms malware detection from static signature matching to dynamic parameter analysis by extracting multiple features including control flow graph metrics, code entropy, API call sequences, and behavioral parameters. These transformed parameters enable the machine learning models to identify malware based on patterns rather than fixed signatures, improving detection effectiveness while the automated feature extraction manages the complexity of analyzing multiple dimensions.
2Measurement precision
If machine learning-based analysis is implemented, then the detection precision and ability to identify latent features improves, but the computational resources and processing time increases
Solution Approach 1:
The patent segments the malware analysis process into distinct stages: initial static analysis to extract basic features, control flow graph generation, selective dynamic analysis only for suspicious samples, and hierarchical machine learning classification. This segmentation allows precision improvement through comprehensive analysis while managing computational resources by applying intensive processing only where needed rather than to all files uniformly.
Solution Approach 2:
The system applies partial analysis to all files (static feature extraction) and reserves excessive/comprehensive analysis (full dynamic execution, detailed control flow graph generation) only for samples that trigger suspicion thresholds. This selective application of analysis depth maintains high precision for detected malware while significantly reducing average computational resource consumption across the entire file processing workload.
3Measurement precision
If comprehensive code analysis is performed, then the accuracy in distinguishing benign and malicious software improves, but the processing speed and productivity decreases
Solution Approach 1:
The patent implements preliminary lightweight filtering using fast static analysis and basic feature extraction to identify potentially malicious samples before applying comprehensive analysis. Quick checks include file type validation, basic entropy calculation, and simple pattern matching that rapidly eliminate benign files, reserving detailed control flow graph analysis and machine learning classification only for suspicious samples, thus maintaining both accuracy and processing speed.
Solution Approach 2:
The system employs periodic analysis with different depths: routine fast scanning for all files, intermediate analysis for files triggering certain thresholds, and comprehensive periodic deep analysis for high-priority or previously identified malware families. This periodic action with varying intensity maintains processing productivity while achieving high accuracy through thorough analysis of priority samples and adequate analysis of others.
Data Source
AI summary
A technique includes processing a plurality of sets of program code to extract call graphs; determining similarities between the call graphs; applying unsupervised machine learning to an input formed from the determined similarities to determine latent features of the input; clustering the determined latent features; and determining a characteristic of a given program code set of the plurality of program code sets based on a result of the clustering.