Partial JAR Decompilation for Real-Time Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for decompiling Java Archive (JAR)/class files are too slow for real-time malware detection, hindering the effectiveness of machine learning models in classifying malicious instructions.
Innovation Solution
Implementing a partial decompilation method that extracts features from JAR/class files using a machine learning model, specifically a Neural Network architecture, to enable faster classification and detection of malicious content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full decompilation of JAR/class files is performed to extract features for malware detection, then detection accuracy is improved, but processing speed deteriorates (too slow for real-time use)
Solution Approach 1:
The patent segments the decompilation process by identifying and extracting only the specific constant pool entries that are relevant for malware detection features, rather than performing complete decompilation of all class files. This selective extraction approach maintains detection accuracy while significantly reducing processing time.
Solution Approach 2:
The patent extracts only the necessary constant pool data (specific entries needed for feature extraction) from JAR/class files, removing unnecessary decompilation steps. This extraction of essential information enables real-time processing while preserving the key features needed for accurate malware detection.
2Loss of information
If complete decompilation is performed to obtain all feature data, then feature completeness is improved, but processing time increases (not suitable for real-time detection)
Solution Approach 1:
The patent applies partial action by performing only the necessary decompilation steps to extract constant pool features, rather than completing full decompilation. This partial processing approach provides sufficient feature data for effective malware detection while reducing processing time to real-time levels.
3Reliability
If traditional decompilation methods are used to extract class file features, then detection thoroughness is improved, but real-time performance deteriorates
Solution Approach 1:
The patent performs preliminary identification of which constant pool entries are needed for feature extraction before actually extracting them. This preliminary action allows the system to prepare extraction targets in advance, enabling faster processing while maintaining thorough detection capabilities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The methods and apparatus for detecting malware using JAR file decompilation are disclosed. An apparatus for decompiling class files, the apparatus comprising a class feature unpacker to unpack a class feature from a class file included in an instruction set, a constant pool address generator to generate a constant pool address table, from the class features, including a plurality of constant pool blocks, based on constant pool type, through an iterative process, a class feature identifier to determine values for each constant pool block based on a constant pool type and store the determined values as a class file feature set, a feature value identifier to obtain raw feature values from a class file feature set and non-class file features, and a feature matrix generator to generate a matrix based on the raw features that correspond to the instruction set.