On-Device Multi-Label Classification for Malware Sub-Categorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional machine learning techniques and behavior-based security solutions fail to accurately identify and respond to malware types in resource-constrained computing devices, leading to inadequate balancing of processing, memory, and energy resources with the severity of risks posed by non-benign behaviors.
Innovation Solution
The implementation of behavior-based machine learning techniques using multi-label classification and meta-classification to classify device behaviors as benign, suspicious, or non-benign, and sub-classify suspicious behaviors into specific malware categories like Adware, Key Logger, Ransomware, etc., determining relative importance and performing tailored analysis and actuation operations based on these classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior-based machine learning techniques are implemented to accurately identify and respond to malware types, then device security and classification accuracy are improved, but processing resources, memory usage, and energy consumption increase
Solution Approach 1:
The patent segments the malware classification process into multiple stages: initial behavior monitoring, preliminary classification using lightweight models, and detailed analysis only for suspicious behaviors. This hierarchical segmentation allows the system to maintain high security accuracy while minimizing energy consumption by applying resource-intensive analysis only when necessary.
Solution Approach 2:
The system performs partial analysis on all behaviors using lightweight machine learning models, and only performs complete detailed analysis on behaviors classified as suspicious. This partial action approach ensures that full computational resources are consumed only for the subset of behaviors that actually require thorough investigation, thereby reducing overall energy consumption while maintaining security reliability.
2Measurement precision
If multi-label classification and meta-classification techniques are used to sub-classify suspicious behaviors into specific malware categories, then classification precision is improved, but device complexity and computational overhead increase
Solution Approach 1:
The classification system is segmented into two distinct modules: a multi-label classification module that identifies multiple malware characteristics simultaneously, and a meta-classification module that integrates these results into specific malware category assignments. This segmentation allows each module to be optimized independently, managing complexity while achieving high classification precision.
Solution Approach 2:
The patent introduces an intermediary behavior representation layer that transforms raw device behaviors into standardized feature vectors before classification. This intermediary representation simplifies the input for both multi-label and meta-classification modules, reducing the complexity of the overall system while maintaining or improving classification precision through normalized feature processing.
3Productivity
If robust behavior-based operations are performed immediately for all suspicious behaviors, then response effectiveness is improved, but processing resources and time consumption increase
Solution Approach 1:
The system performs immediate robust behavior-based operations only on behaviors that are classified as suspicious with high confidence, while applying lighter responses or monitoring to behaviors with lower confidence scores. This selective application of robust operations maintains high response effectiveness for critical threats while reducing overall time consumption by avoiding exhaustive analysis of all suspicious behaviors.
Solution Approach 2:
The patent implements preliminary confidence assessment and triage operations before executing robust behavior-based responses. By preliminarily evaluating the confidence level and risk profile of each suspicious behavior, the system can prioritize and schedule robust operations efficiently, ensuring critical threats are addressed immediately while less critical cases are handled with reduced resource allocation.
Data Source
AI summary
Various aspects include methods and computing devices implementing the methods for evaluating device behaviors in the computing devices. Aspect methods may include using a behavior-based machine learning technique to classify a device behavior as one of benign, suspicious, and non-benign. Aspect methods may include using one of a multi-label classification and a meta-classification technique to sub-classify the device behavior into one or more sub-categories. Aspect methods may include determining a relative importance of the device behavior based on the sub-classification, and determining whether to perform robust behavior-based operations based on the determined relative importance of the device behavior.