Multi-Representational Learning for Source Code Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques face challenges in efficiently and accurately identifying malicious source code without performing dynamic analysis, which is costly and not scalable, and rely heavily on database lookups or hand-crafted features that are difficult to update and can be circumvented by adversaries.
Innovation Solution
The development of multi-representational learning (MRL) models that abstract source code into different layers such as characters, tokens, and Abstract Syntax Trees (ASTs), allowing for the extraction of complementary features and the creation of feature vectors for efficient static classification, using techniques like Convolutional Neural Networks (CNNs) for classification without the need for dynamic execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is used for malware detection, then detection accuracy is improved, but computational cost and scalability deteriorate
Solution Approach 1:
The patent creates static copies of source code representations (character sequences, token sequences, AST representations) that capture the essential structural and semantic features of malware without requiring actual execution. These copied representations enable accurate classification while avoiding the computational overhead of dynamic analysis.
Solution Approach 2:
The patent replaces the mechanical execution process (dynamic analysis) with machine learning-based classification systems that process static code representations. Multiple ML models analyze different code representations and aggregate their predictions, substituting the need for actual code execution with computational modeling.
2Speed
If database lookups or hand-crafted features are used for malware detection, then detection speed is improved, but adaptability to novel threats deteriorates
Solution Approach 1:
The patent implements dynamic model selection and aggregation where multiple machine learning models with different strengths are selected and combined based on the specific code representation being analyzed. This dynamic approach allows the system to adapt to various malware types and techniques while maintaining fast detection speeds through efficient model execution.
Solution Approach 2:
The patent creates a composite detection system that combines multiple machine learning models analyzing different code representations (characters, tokens, AST). This composite approach integrates the strengths of various models and representations, creating a robust system that is both fast and highly adaptable to novel threats.
3Measurement precision
If multiple code representations are analyzed, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent segments the code analysis process into distinct stages, each handling a specific code representation (character-level, token-level, AST-level). Different machine learning models are assigned to different segmentation levels, allowing for specialized analysis that improves accuracy while managing complexity through modular organization.
Solution Approach 2:
The patent develops universal machine learning models that can process multiple types of code representations and aggregate their outputs. These multi-functional models reduce overall system complexity by providing a unified framework that handles diverse inputs, rather than requiring separate specialized models for each representation type.
Data Source
AI summary
A system/process/computer program product for building multi-representational learning models for static analysis of source code includes receiving training data, wherein the training data includes a set of source code files for training a multi-representational learning (MRL) model for classifying malicious source code and benign source code based on a static analysis; generating a first feature vector based on a set of characters extracted from the set of source code files; generating a second feature vector based on a set of tokens extracted from the set of source code files; and performing an ensemble of the first feature vector and the second feature vector to form a target feature vector for classifying malicious source code and benign source code based on the static analysis.