Neural Network Virus Detection via Dynamic Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying and removing viruses, such as feature scanning and human rule behavior heuristic scanning, are inefficient in detecting new and polymorphic viruses, especially as virus databases grow and virus behavior evolves.
Innovation Solution
A method and device utilizing a detection network, like a back propagation neural network, to execute abnormal applications, obtain dynamic behavior information, convert it into a behavior vector, and identify abnormal applications based on behavior rules learned from the network, enhancing the efficiency of virus scanning and removal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If feature scanning method is used to identify viruses by comparing suspicious files with virus features in a database, then known viruses can be detected, but unknown viruses and polymorphic viruses cannot be identified and the virus feature database becomes increasingly large reducing scanning efficiency
Solution Approach 1:
The patent replaces the traditional mechanical feature-matching system with a neural network-based intelligent detection system. Instead of manually comparing file features against a growing database, the system uses a neural network to automatically learn virus patterns from behavior data, substituting mechanical comparison with intelligent recognition that scales efficiently.
Solution Approach 2:
The neural network performs self-learning by automatically analyzing runtime behavior data and generating detection rules without human intervention. The system serves itself by continuously improving its detection capabilities through automated training on new virus samples, eliminating the need for manual feature database updates.
2Adaptability or versatility
If human rule behavior heuristic scanning method is used to manually analyze virus samples and summarize behavior rules, then some unknown viruses can be identified, but the manual analysis process is inefficient and cannot keep pace with continuously evolving viruses
Solution Approach 1:
The system automates the previously manual behavior analysis process. The neural network automatically collects runtime behavior data, learns patterns, and generates detection rules without human intervention, enabling the system to adapt to new viruses as quickly as they evolve while maintaining high scanning efficiency.
Solution Approach 2:
The patent introduces a neural network as an intermediary between raw behavior data and detection rules. This intermediary automatically processes and interprets complex behavior patterns, translating them into actionable detection rules without requiring manual analysis, thus bridging the gap between data collection and virus identification.
3Adaptability or versatility
If the virus feature database is continuously expanded to cover more virus types including polymorphic and hidden viruses, then detection coverage improves, but the scanning and killing efficiency decreases due to the larger database size
Solution Approach 1:
The patent replaces the mechanical database-matching approach with an intelligent neural network system that doesn't rely on storing extensive feature databases. The neural network learns detection patterns from relatively small amounts of training data and generalizes to detect diverse virus types, maintaining high detection coverage while preserving scanning efficiency.
Solution Approach 2:
The system changes the fundamental parameter from storing extensive virus feature data to storing compact neural network models that have learned detection patterns. This parameter change allows the system to maintain high detection coverage through learned patterns rather than exhaustive databases, thereby preserving scanning efficiency.
Data Source
AI summary
A method and device for identifying an abnormal application are provided. The method includes executing abnormal applications, obtaining dynamic behavior information of the abnormal applications, inputting the dynamic behavior information of the abnormal applications into a preset detection network, obtaining a behavior rule of the dynamic behavior information via the detection network, and identifying a detected application according to the behavior rule to determine whether the detected application is an abnormal application.