Neural Network Obfuscated Script Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect obfuscated scripts in files, as they often evade signature-based detection and struggle to capture associations between strings indicative of malicious activity, leading to potential harm from seemingly harmless files.
Innovation Solution
An apparatus and method using a neural network that extracts features from files, generates n-gram representations, and defines a feature vector to classify potentially malicious files, analyzing hidden associations between scripts to determine maliciousness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to detect malicious scripts, then detection speed is maintained, but detection accuracy deteriorates because obfuscated scripts evade signature-based detection
Solution Approach 1:
The patent replaces signature-based detection (mechanical pattern matching) with machine learning-based detection. The neural network automatically learns malicious patterns from training data, substituting the manual signature creation process with an automated learning system that can detect obfuscated scripts without relying on pre-defined signatures.
Solution Approach 2:
The patent changes the detection parameters from fixed signatures to dynamic features extracted by the neural network. Instead of matching against static signature patterns, the system analyzes multiple features including n-gram representations, script characteristics, and contextual information to dynamically determine maliciousness, enabling detection of previously unseen obfuscated scripts.
2Measurement precision
If feature extraction is performed to capture script characteristics, then detection capability is improved, but associations between strings indicative of malicious activity are not captured
Solution Approach 1:
The patent adds a new dimension to feature extraction by incorporating n-gram representations that capture sequential associations between strings. Instead of treating each script characteristic independently, the n-gram approach analyzes sequences of characters and words, preserving the contextual relationships and associations between malicious indicators that traditional feature extraction methods miss.
Solution Approach 2:
The patent segments the script text into n-gram units (sequences of n characters or words) to analyze local patterns and associations. This segmentation allows the neural network to capture meaningful substrings and phrase patterns that indicate malicious activity, such as specific command sequences or obfuscation techniques, while maintaining the contextual relationships between adjacent elements.
3Measurement precision
If multiple n-gram representations of different sizes are generated, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by generating n-gram representations of multiple sizes (e.g., unigrams, bigrams, trigrams) rather than analyzing the entire script at once. This allows the neural network to focus on the most relevant local patterns and associations, achieving high detection accuracy while reducing the computational burden compared to analyzing all possible substrings or maintaining overly granular feature sets throughout processing.
Data Source
AI summary
In some embodiments, an apparatus includes a memory and a processor. The processor can further be configured to extract a set of scripts from potentially malicious a file. The processor can further be configured to concatenate a representation of each script from the set of scripts with a representation of the remaining scripts from the set of scripts to define a script string. The processor can further be configured to define a feature vector based on the set of n-gram representations of the script string for input of the feature vector to a neural network for output. The processor can further be configured to identify, based on the output from the neural network, a maliciousness classification of the file.