Mutex Entropy Calculation for File-Less Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and diversity of malware attacks, particularly file-less malware, pose challenges for computer security systems as they often hide within operating system binaries using mutexes, making it difficult to detect and classify malicious content effectively.
Innovation Solution
A system utilizing a deep learning model to determine mutex entropy by normalizing mutex identifier strings, calculating character probabilities based on historical character distributions, and classifying mutexes as clean or malicious, thereby mitigating malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection of conventional malware is effective, but detection of file-less malware hiding in mutexes becomes difficult
Solution Approach 1:
The patent transforms the detection approach by changing from analyzing malware behavior patterns to analyzing the entropy parameter of mutex identifier strings. By calculating entropy values and comparing them against threshold values, the system can reliably detect file-less malware that traditional methods miss, thus improving both detection effectiveness and adaptability to new malware types.
2Measurement precision
If mutex entropy calculation is performed on all mutexes, then classification accuracy improves, but computational overhead increases
Solution Approach 1:
The patent applies entropy calculation selectively rather than uniformly to all mutexes. By focusing computational resources on calculating entropy for suspicious or newly created mutexes, the system achieves high classification accuracy while minimizing unnecessary computational overhead on routine operations.
Solution Approach 2:
The system uses entropy threshold values to classify mutexes, transforming a continuous computational problem into a discrete decision process. This parameter-based classification allows for accurate malware detection while reducing computational complexity compared to full behavioral analysis of each mutex.
3Measurement precision
If entropy threshold values are updated frequently, then malware classification accuracy improves, but system complexity increases
Solution Approach 1:
The system implements feedback mechanisms where entropy threshold values are updated based on classified malware samples. This continuous learning process improves classification accuracy over time while maintaining manageable system complexity through automated threshold adjustment rather than manual configuration.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed to determine mutex entropy for malware classification. An example apparatus includes interface circuitry to access a mutex associated with a software application, the mutex to include a mutex identifier string, normalizer circuitry to normalize the mutex identifier string, character probability circuitry to determine character probabilities of characters within the normalized mutex identifier string, the character probabilities based on a historical mutex character distribution, entropy calculator circuitry to calculate an entropy value for the mutex based on the character probabilities, classifier circuitry to classify the mutex as clean or malicious based on the entropy value, and protector circuitry to mitigate malicious attacks based on the classification.