Phantom Nodes in Label Propagation for Malware Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware software often mislabels files as malware or clean, leading to false positives and negatives, which can cause disruptions and infections, and negatively impact the software provider's reputation.
Innovation Solution
A system and method that create a graph of sample files and behavior nodes, using label propagation with phantom nodes to identify mislabeled samples by determining label distributions and calculating a neighborhood opinion to correct misclassifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If label propagation is used to classify malware files, then classification speed is improved, but mislabeling occurs leading to false positives and negatives
Solution Approach 1:
The patent introduces a feedback mechanism where the system monitors label distributions of neighboring nodes and uses this information to detect and correct mislabeling. When a node's label distribution deviates from the consensus of its neighbors, the system triggers a correction process that updates the label, thereby maintaining high reliability while preserving the speed benefits of label propagation.
Solution Approach 2:
The patent replaces the mechanical voting mechanism with a probabilistic label distribution approach. Instead of simple majority voting, the system uses soft label distributions that represent the confidence levels of different classes, allowing for more nuanced decision-making and reducing false positives while maintaining classification speed through efficient probability propagation.
2Reliability
If strict labeling rules are applied to ensure accuracy, then false positives are reduced, but mislabeled files cannot be corrected
Solution Approach 1:
The patent implements dynamic labeling where the system can adapt its labeling decisions based on real-time analysis of neighborhood consensus. The labeling rules are not fixed but can adjust based on the observed label distributions of neighboring nodes, allowing the system to correct mislabeling while maintaining strict accuracy standards through flexible, data-driven rule adjustment.
Solution Approach 2:
The system changes the parameters of label confidence and distribution based on neighborhood analysis. When a node's label distribution shows significant deviation from the neighborhood consensus, the system adjusts the confidence parameters and triggers a correction process, enabling the system to both maintain accuracy and correct mislabeling adaptively.
3Reliability
If manual verification of each file is performed, then label accuracy is improved, but processing time increases significantly
Solution Approach 1:
The patent implements self-service verification where the system automatically verifies label accuracy by analyzing the label distributions of neighboring nodes. Each node performs self-verification by comparing its label against the consensus of its neighbors, eliminating the need for manual verification while maintaining high accuracy. This distributed self-verification approach preserves processing time efficiency.
Solution Approach 2:
The system uses feedback from neighborhood label distributions to automatically verify and correct mislabeling. The feedback mechanism allows the system to self-correct without human intervention, maintaining high label accuracy while avoiding the time cost of manual verification. The feedback loop continuously monitors and adjusts labels based on neighborhood consensus.
4Reliability
If a graph structure with many nodes and edges is created, then label propagation accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the graph into functional components: sample file nodes, behavior nodes, and phantom nodes. This segmentation allows the system to manage complexity by organizing the graph into meaningful categories with specific roles. The behavior nodes act as intermediaries that capture common characteristics, reducing the need for direct connections between all sample files and simplifying the overall graph structure while maintaining propagation accuracy.
Solution Approach 2:
The patent introduces phantom nodes as intermediaries between sample file nodes and behavior nodes. These phantom nodes aggregate label distributions from multiple sample files before propagating to behavior nodes, reducing the direct complexity of connections. The intermediary phantom nodes simplify the graph structure by consolidating information flow while maintaining the accuracy benefits of comprehensive graph analysis.
Data Source
AI summary
Systems and method identify potentially mislabeled file samples. A graph is created from a plurality of sample files. The graph includes nodes associated with the sample files and behavior nodes associated with behavior signatures. Phantom nodes are created in the graph for those sample files having a known label. During a label propagation operation, a node receives data indicating a label distribution of a neighbor node in the graph. In response to determining that the current label for the node is known, a neighborhood opinion is determined for the associated phantom node, based at least in part on the label distribution of the neighboring nodes. After the label propagation operation has completed, differences between the neighborhood opinion and the current label distribution for nodes are determined. If the difference exceeds a threshold, then the current label may be incorrect.