Neural Malware Classification for Variable-Length Executable Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, including signature-based approaches and artificial intelligence techniques, face challenges in identifying novel malware due to their reliance on fixed feature vectors and prior knowledge, which can lead to false senses of security and inadequate detection of malicious code with variable properties.
Innovation Solution
A machine learning system utilizing a neural network architecture with convolutional and recurrent layers, capable of analyzing variable-length source data, extracts features through Shannon entropy calculations and embeddings, allowing for the classification of malware regardless of its length or format, and can be deployed on computing devices or in cloud-based systems for real-time detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware detection is used, then known malware can be identified, but newly created malware with unknown signatures cannot be detected
Solution Approach 1:
The patent transforms malware detection from signature-based to property-based analysis by changing the detection parameters from fixed signatures to variable properties such as API call sequences, system call patterns, and behavioral characteristics. This allows the system to detect both known and novel malware by analyzing their operational properties rather than relying on pre-defined signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with an AI-based neural network system that learns malware properties from training data. The neural network automatically extracts and analyzes malware characteristics, substituting the rigid mechanical approach with an adaptive intelligent system that can generalize to detect new malware variants.
2Ease of operation
If fixed-length feature vectors are used in neural networks, then standard processing can be applied, but variable-length malware code cannot be adequately analyzed
Solution Approach 1:
The patent segments variable-length malware code into fixed-length windows or blocks, allowing each segment to be processed independently by the neural network. This segmentation enables the system to handle arbitrary-length input by dividing it into manageable units that can be fed into standard fixed-length neural network architectures.
Solution Approach 2:
The patent introduces temporal or sequential dimensions to the analysis by processing malware properties as sequences or time-series data. This dimensional transformation allows the neural network to capture relationships across different parts of the malware while maintaining compatibility with standard processing architectures through techniques like recurrent layers or attention mechanisms.
3Measurement precision
If a priori knowledge of malware properties is required, then detection can be targeted, but malware with novel properties escape detection
Solution Approach 1:
The patent performs preliminary training of the neural network on a comprehensive dataset of malware properties before deployment. This preliminary action allows the system to learn a broad range of malware characteristics and patterns, enabling it to detect both known and novel malware without requiring specific prior knowledge about the target malware's properties.
Solution Approach 2:
The patent implements a self-learning system where the neural network automatically adapts to new malware types by learning from training data without requiring manual configuration of detection parameters. The system serves itself by continuously improving its detection capabilities through exposure to diverse malware samples, eliminating the need for a priori knowledge of specific malware properties.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Example techniques described herein determine a classification of a variable-length source data such as an executable code. A neural network system that includes a convolution filter, a recurrent neural network, and a fully connected layer can be configured in a computing device to classify executable code. The neural network system can receive executable code of variable length and reduce its dimensionality by generating a variable-length sequence of features extracted from the executable code. The sequence of features is filtered, and applied to one or more recurrent neural networks and to a neural network. The output of the neural network classifies the data. Other disclosed systems include a system for reducing the dimensionality of command line input using a recurrent neural network. The reduced dimensionality of command line input may be classified using the disclosed neural network systems.