Neural Network Malicious Code Variant Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious code variants are inefficient due to manual analysis and signature generation, which struggle to keep pace with rapidly increasing variants and automated propagation, especially in reflecting complex data features.
Innovation Solution
An apparatus and method utilizing a neural network with a data conversion unit to convert one-dimensional binary codes into two-dimensional data, enabling deep learning for feature extraction and classification without requiring separate feature extraction tools, employing convolution and pooling layers to detect malicious code categories.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing signature-based detection methods are used, then detection process is simple, but detection capability against variants is poor
Solution Approach 1:
The patent replaces manual analysis and signature-based detection methods with an automated deep learning system. The neural network automatically extracts features from binary codes and detects malicious code variants, eliminating the need for manual feature extraction and signature generation. This substitution of mechanical/manual processes with automated intelligent systems resolves the contradiction by maintaining simple operation while dramatically improving detection capability against variants.
Solution Approach 2:
The deep learning system performs self-learning and automatic feature extraction without requiring manual intervention. The neural network automatically adapts to new variants through continuous learning, eliminating the need for manual updates to detection signatures. This self-service capability maintains operational simplicity while improving reliability against evolving threats.
2Productivity
If manual analysis and signature generation are used, then feature extraction is simple, but analysis time is long
Solution Approach 1:
The patent replaces manual feature extraction with automated deep learning-based feature extraction. The neural network automatically processes binary codes and extracts relevant features without human intervention, dramatically reducing analysis time while handling complex variant detection. This automation resolves the contradiction by eliminating manual labor bottlenecks while managing extraction complexity through intelligent algorithms.
3Reliability
If existing static analysis method is used, then data processing is simple, but feature reflection capability is poor
Solution Approach 1:
The patent transforms one-dimensional binary code data into two-dimensional data representations that can be processed by convolutional neural networks. This dimensional transformation enables the system to capture complex spatial relationships and patterns in the binary codes that would be invisible to traditional one-dimensional analysis methods. The increased dimensionality improves feature reflection capability while the automated processing manages the complexity.
Solution Approach 2:
The patent employs a composite approach combining multiple neural network layers (convolutional layers, pooling layers, fully connected layers) to process data. This composite structure integrates different processing functions at various levels, enabling comprehensive feature extraction and reflection that surpasses simple static analysis while managing complexity through modular architecture.
4Reliability
If neural network deep learning is used, then detection capability is improved, but computation complexity increases
Solution Approach 1:
The patent segments the detection process into distinct neural network layers with specialized functions: convolutional layers for feature extraction, pooling layers for dimensionality reduction, and fully connected layers for classification. This segmentation allows each layer to focus on specific tasks, improving overall detection capability while managing computation complexity through functional decomposition and optimized processing at each stage.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6(C)
AI summary
The present invention provides an apparatus for detecting variants of malicious code based on neural network learning, a method therefor and a computer readable recording medium storing a program for performing the method. According to the present invention, one-dimensional binary data is converted into two-dimensional data without separate extraction of features, and deep learning is performed through a neural network having a nonlinear multilayered structure, such that the features of the malicious code and variants thereof may be extracted by performing the deep learning. Therefore, since no separate feature extraction tool or artificial effort by an expert is required, an analysis time is reduced, and variants of malicious code that cannot be captured by existing malicious code classification tools may be detected by performing the deep learning.