Portable Executable Malware Recognition with Attribute Tagging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods, including signature techniques and machine learning, struggle to provide detailed descriptions of malware types and require resource-intensive recovery processes.
Innovation Solution
A machine learning model trained with features of portable executable files and attribute indicators is used to recognize malware, providing a threat score and attribute indicator as output, enabling remedial actions and improved malware identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature techniques are used to recognize malware, then malware can be identified with detailed descriptions, but the detection precision and adaptability to new malware are insufficient
Solution Approach 1:
The malware detection task is segmented into two independent machine learning models: one model predicts the threat score (maliciousness), while the other model predicts the malware type (attribute indicator). This segmentation allows each model to specialize in its specific task, improving both detection accuracy and adaptability to new malware variants.
Solution Approach 2:
The patent transforms the traditional single-output detection problem into a multi-dimensional output problem by simultaneously predicting both threat score and malware type. This dimensional expansion provides more comprehensive malware characterization without compromising detection precision.
2Productivity
If traditional machine learning techniques are used, then detection speed improves, but detailed descriptions of malware types are not provided
Solution Approach 1:
The detection process is divided into two parallel prediction tasks executed by separate model outputs: threat assessment and malware classification. This enables the system to maintain high detection speed while simultaneously providing detailed malware type information, eliminating the information loss in traditional approaches.
Solution Approach 2:
The machine learning model is designed to perform multiple functions simultaneously: it not only detects whether a file is malware but also classifies the specific malware type. This multi-functionality ensures both rapid detection and comprehensive information provision without requiring separate analysis processes.
3Measurement precision
If comprehensive malware analysis is performed, then malware type identification improves, but resource consumption increases
Solution Approach 1:
The comprehensive analysis is segmented into two focused prediction tasks handled by a single trained model architecture. By segmenting the output requirements (threat score + malware type) rather than performing sequential full analyses, the system achieves accurate malware type classification with reduced computational overhead compared to traditional comprehensive scanning approaches.
Data Source
AI summary
In general, in one aspect, a method for machine learning recognition of portable executable files as malware includes providing training data comprising features of portable executable files and descriptive information for the portable executable files, the descriptive information comprising a family or type of malware. The method may include training a model using the training data to detect malware. The method may include using the trained model to recognize malware by providing features of a portable executable file as input and providing a threat score and descriptive information as output.