Partial JAR Decompilation for Real-Time Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for decompiling Java Archive (JAR)/class files are too slow for real-time malware detection, hindering the effectiveness of machine learning models in classifying malicious instructions.

Innovation Solution

Implementing a partial decompilation method that extracts features from JAR/class files using a machine learning model, specifically a Neural Network architecture, to enable faster classification and detection of malicious content.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If full decompilation of JAR/class files is performed to extract features for malware detection, then detection accuracy is improved, but processing speed deteriorates (too slow for real-time use)

Engineering Contradiction:
Improvemalware detection accuracyVSAvoidprocessing speed
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the decompilation process by identifying and extracting only the specific constant pool entries that are relevant for malware detection features, rather than performing complete decompilation of all class files. This selective extraction approach maintains detection accuracy while significantly reducing processing time.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent extracts only the necessary constant pool data (specific entries needed for feature extraction) from JAR/class files, removing unnecessary decompilation steps. This extraction of essential information enables real-time processing while preserving the key features needed for accurate malware detection.

Inventive Principle:
Principle #2Taking out (Extraction)

2Loss of information

If complete decompilation is performed to obtain all feature data, then feature completeness is improved, but processing time increases (not suitable for real-time detection)

Engineering Contradiction:
Improvefeature completenessVSAvoidprocessing time
Core Design Contradiction:
Loss of informationVSLoss of time

Solution Approach 1:

The patent applies partial action by performing only the necessary decompilation steps to extract constant pool features, rather than completing full decompilation. This partial processing approach provides sufficient feature data for effective malware detection while reducing processing time to real-time levels.

Inventive Principle:
Principle #16Partial or excessive action

3Reliability

If traditional decompilation methods are used to extract class file features, then detection thoroughness is improved, but real-time performance deteriorates

Engineering Contradiction:
Improvedetection thoroughnessVSAvoidreal-time detection speed
Core Design Contradiction:
ReliabilityVSSpeed

Solution Approach 1:

The patent performs preliminary identification of which constant pool entries are needed for feature extraction before actually extracting them. This preliminary action allows the system to prepare extraction targets in advance, enabling faster processing while maintaining thorough detection capabilities.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP4014461B1Methods and apparatus for malware detection using jar file decompilation
Publication Date: 2024.11.20 MCAFEE LLC
  • EP4014461B1 patent drawingFigure 1
  • EP4014461B1 patent drawingFigure 2
  • EP4014461B1 patent drawingFigure 3

AI summary

The methods and apparatus for detecting malware using JAR file decompilation are disclosed. An apparatus for decompiling class files, the apparatus comprising a class feature unpacker to unpack a class feature from a class file included in an instruction set, a constant pool address generator to generate a constant pool address table, from the class features, including a plurality of constant pool blocks, based on constant pool type, through an iterative process, a class feature identifier to determine values for each constant pool block based on a constant pool type and store the determined values as a class file feature set, a feature value identifier to obtain raw feature values from a class file feature set and non-class file features, and a feature matrix generator to generate a matrix based on the raw features that correspond to the instruction set.