ML Malware Detection via Memory Image Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in identifying malicious executables due to obfuscation techniques, such as compressed or encrypted code, which conceal the true purpose and function of malware, making it difficult to detect through signature-based methods.
Innovation Solution
A machine learning-based approach that analyzes memory image data from running processes to identify features indicative of malware, using feature extractors to capture byte n-grams, strings, and entropy levels, and trains a model to classify processes as malicious or benign, bypassing obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used, then detection speed is maintained, but detection capability deteriorates due to obfuscation techniques
Solution Approach 1:
The patent replaces traditional signature-based mechanical detection methods with machine learning-based analysis. Instead of searching for fixed byte patterns, the system uses trained models to analyze memory image data and identify malware characteristics, thereby overcoming obfuscation techniques while maintaining detection effectiveness.
Solution Approach 2:
The patent changes the detection parameters from fixed signatures to dynamic features extracted from memory images. By analyzing multiple parameters such as byte n-grams, entropy levels, and process behavior patterns, the system adapts to detect obfuscated malware that would be invisible to traditional signature-based approaches.
2Measurement precision
If memory image analysis is performed, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent performs preliminary actions by capturing memory images at specific points in the execution lifecycle and pre-processing them into standardized formats. Feature extractors are pre-configured to identify relevant characteristics, and machine learning models are trained in advance, enabling faster real-time detection without sacrificing accuracy.
Solution Approach 2:
The patent extracts only the essential features from memory image data using dedicated feature extractors. Instead of analyzing entire memory dumps, the system selectively extracts byte n-grams, entropy values, and other critical features, significantly reducing processing time while maintaining high detection accuracy.
3Object-affected harmful factors
If obfuscation techniques are applied, then malware evasion capability improves, but detectability worsens
Solution Approach 1:
The patent converts the harmful effect of obfuscation into a beneficial detection opportunity. By analyzing memory images where obfuscated code has been partially decoded or is being executed, the system can identify characteristic patterns and behaviors that reveal the malware's true nature, turning the evader's defense into a detection advantage.
Data Source
AI summary
A plurality of memory image data is obtained. Respective ones of the memory image data may include captured memory contents from an executing process. Training data including feature vectors and classification values are provided to a machine learning (ML) training model executing on a processing device. The feature vectors may include indications of patterns within the memory image data. The ML training model is trained based on the training data to generate an ML production model. The training may include computing a plurality of model parameters that relate the feature vectors of the training data to the classification values of the training data.