Offline Endpoint Malware Analysis with Local AI Retraining

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional AI models struggle to detect all threat types equally well on offline endpoints due to evolving threats and lack of fine-tuning, and sending files or metadata to a backend cloud for retraining consumes bandwidth and compromises privacy.

Innovation Solution

A self-learning AI-based malware analyzer for offline endpoints that scans, executes files to detect malicious behavior, extracts attributes, and retrains the machine learning algorithm locally to improve detection without cloud connectivity, sharing attributes with similar systems for enhanced security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional AI models are used for malware detection on offline endpoints, then the system can operate without cloud connectivity, but the detection accuracy is insufficient due to inability to adapt to evolving threats

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidadaptability to evolving threats

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements self-service by enabling the machine learning algorithm to retrain locally on the offline endpoint using attributes extracted from executed files. This allows the system to autonomously adapt to new threat patterns without requiring cloud connectivity or manual intervention, thereby improving both detection accuracy and adaptability to evolving threats

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs preliminary action by executing files in a controlled environment before they can cause harm, extracting attributes from these executions, and using this information to retrain the detection algorithm in advance. This proactive approach enables the system to prepare defenses against emerging threats before they fully manifest

Inventive Principle:

Principle #10Preliminary action

2Reliability

If files and metadata are sent to backend cloud for retraining, then the AI model can be improved, but bandwidth is consumed and privacy is compromised

Engineering Contradiction:

Improvedetection accuracyVSAvoidbandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent applies the extraction principle by isolating only the necessary file attributes (metadata) from the complete file, and processing this extracted information locally on the endpoint. This eliminates the need to transmit entire files to the cloud, significantly reducing bandwidth consumption while still providing sufficient data for effective model retraining and improvement

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system introduces an intermediary layer of local processing that acts as a mediator between file execution and cloud communication. By extracting attributes locally and only transmitting essential training data when online, the system reduces direct cloud dependency, minimizes bandwidth usage, and maintains privacy while still enabling model improvement

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If files are executed to detect malicious behavior, then the system can learn from actual behavior, but there is risk of executing malicious files

Engineering Contradiction:

Improvedetection accuracyVSAvoidrisk of executing malicious files

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements beforehand cushioning by creating a controlled, isolated execution environment for files before they can cause harm to the main system. The sandboxed environment acts as a protective buffer that contains any malicious behavior, allowing safe observation and attribute extraction without exposing the endpoint to actual damage

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Solution Approach 2:

The system converts the potential harm of executing malicious files into a benefit by using the malicious behavior itself as training data. Files that execute and exhibit malicious behavior in the sandboxed environment provide valuable information for retraining the detection algorithm, turning security threats into learning opportunities that improve future detection accuracy

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS12563049B2Systems and methods for A.I.-based malware analysis on offline endpoints in a network

Publication Date: 2026.02.24 ACRONIS INT

AI summary

Disclosed herein are systems and method for optimizing artificial intelligence (A.I)-based malware analysis on offline endpoints in a network. In one aspect, a method includes identifying a file that has not been executed on an endpoint system and scanning the endpoint system to detect malicious behavior using a machine learning algorithm. In response to determining that the endpoint system does not exhibit malicious behavior based on the machine learning algorithm, the method includes enabling execution of the file. Subsequent to the execution of the file, the method includes rescanning the endpoint system to detect malicious behavior using the machine learning algorithm. In response to determining that the endpoint system does exhibit malicious behavior subsequent to the execution, the method includes extracting attributes of the file and retraining the machine learning algorithm using the extracted attributes to detect malicious behavior associated with the file without having to execute the file.