Malicious PE File Detection via Sparse Self-Encoding Vector Fusion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious PE files are heavily dependent on third-party tools, require complex processes, and have limited scope, leading to instability and accuracy issues in practical applications.
Innovation Solution
A method involving structured disassembly of PE files using sparse self-encoding neural networks and text classification models, followed by vector fusion and knowledge transfer, to achieve targeted and concise malicious detection without the need for shell checking or disassembly tools.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If automated shelling-off technology is used, then the detection process becomes more automated, but the system still requires software static analysis combined with sandbox environment and manual repairing, increasing device complexity
Solution Approach 1:
The patent implements self-service by enabling the system to automatically perform shelling-off detection and assembly code acquisition without requiring manual intervention. The automated shelling-off technology combined with sandbox environment allows the system to self-detect and handle shell-coded files, eliminating the need for manual repairing and reducing overall system complexity despite the automated processes involved.
Solution Approach 2:
The patent introduces a sandbox environment as an intermediary component that mediates between the automated shelling-off technology and the detection system. This intermediary layer enables automated analysis of suspicious files in a controlled environment, allowing the system to handle complex shell-coded files automatically without directly complicating the main detection architecture.
2Loss of information
If multi-step processing is used to obtain assembly function data, then the model input becomes more comprehensive, but the technology becomes heavily dependent on third-party tools like shell checking and disassembly tools
Solution Approach 1:
The patent extracts and integrates the functionality of external third-party tools (shell checking tools, disassembly tools) directly into the detection system. By taking out these dependencies and embedding their capabilities within the system, it maintains comprehensive data processing through multi-step processing while eliminating heavy dependence on external tools, thereby reducing device complexity and tool dependencies.
3Measurement precision
If comprehensive environmental dependencies are required for detection, then the detection accuracy may be improved, but more memory and computational resources are consumed
Solution Approach 1:
The patent applies partial action by selectively applying comprehensive environmental dependencies only when necessary for accurate detection. Rather than always requiring full environmental context, the system intelligently determines when simplified processing suffices and when comprehensive analysis is needed, thereby maintaining detection accuracy for critical cases while reducing memory and computational resource consumption for routine detections.
Data Source
AI summary
The disclosure relates to the field of artificial intelligence. Disclosed in the disclosure are a method and apparatus for detecting a malicious Portable Executable (PE) file, and a device and a medium. The method includes: disassembling a target PE file according to a preset file disassembling method, so as to acquire file header information, file optional header information, file section header information, and section information; using a trained sparse self-encoding neural network model to respectively vectorize each piece of header information, and using a trained text classification model to vectorize the section information; and fusing each vectorized vector, and inputting fused vectors into a neural network model, so as to acquire a detection result outputted by the neural network model. The neural network model is obtained by using a preset knowledge transfer method to perform model transfer on each trained sparse self-encoding neural network model and text classification model.