Quantized Step Machine Learning for Malware Detection Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques using machine learning models on smartphones suffer from latency and produce undesirable false negatives and false positives due to the need for waiting until a specific point in time or event count is reached during software package execution, which hinders timely identification of malware.
Innovation Solution
The system generates a set of events associated with specific step points during training and execution, creating multiple step models for each step point, allowing for the application of these models in quantized steps to evaluate the presence of malware, thereby reducing latency and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a machine learning model waits until a specific point in time or event count is reached during software package execution, then the detection accuracy is improved, but the latency increases and false negatives/false positives occur
Solution Approach 1:
The patent segments the detection process into multiple quantized steps based on event counts or time intervals. Instead of waiting for a single fixed point, the system creates step models at different quantization levels (e.g., every 100 events or 1 second) and applies them progressively as events are generated during file execution. This allows early detection at intermediate points while maintaining accuracy through multiple evaluation opportunities.
Solution Approach 2:
The system performs preliminary actions by pre-training multiple step models at different quantization points during the offline training phase. These pre-trained models are then ready for immediate application during runtime, eliminating the need to wait for specific time points or event counts to occur before detection can begin. The models are prepared in advance for various execution scenarios.
2Measurement precision
If a machine learning model waits until a specific point in time or event count is reached during software package execution, then the detection accuracy is improved, but the ability to identify malware timely deteriorates
Solution Approach 1:
The detection process is divided into multiple quantized steps where step models are applied at different intervals during file execution. This segmentation enables the system to perform multiple detection evaluations throughout the execution process rather than a single evaluation at a fixed point, thereby improving timely identification while maintaining accuracy through the use of appropriately trained step models at each quantization level.
Solution Approach 2:
The system maintains continuous detection capability by applying step models progressively as events are generated during file execution. Rather than pausing to wait for a specific endpoint, the detection process continues continuously through multiple quantized steps, with each step model providing detection capability at its corresponding event count or time interval, ensuring no detection opportunity is lost.
3Ease of manufacture
If a machine learning model uses data from a specific period in time or during a certain number of events, then the model training is simplified, but false negatives and false positives increase when testing short sequences of events
Solution Approach 1:
The system changes the parameter of quantization level to match the duration and event count of the file being tested. By adjusting the quantization parameter dynamically based on file characteristics, the system ensures that step models are applied at appropriate intervals for both short and long execution sequences. This parameter adaptation maintains detection reliability across varying file types while preserving the simplicity of using event-count-based training data.
Data Source
AI summary
Minimizing the latency of on-device detection of malicious executable files, without sacrificing accuracy, by applying a machine learning model to an executable file in quantized steps. Allowing a threshold confidence level to be set to different values enables controlling the tradeoff between accuracy and latency in generating a confidence level indicative of whether the executable file includes malware.