Realtime Engine Selection for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Real-time applications face performance degradation due to the resource-intensive nature of multiple anti-malware engines, making it challenging to effectively identify malware while managing resource constraints.
Innovation Solution
A system that selects the most appropriate classification engines based on their expertise for specific entities, using lightweight classifiers to determine the best set of 'expensive' engines to use, which can include voting and ranking mechanisms to combine outputs for enhanced efficacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple classification engines are applied to improve detection accuracy, then precision in malware identification is improved, but performance of real-time applications deteriorates due to resource constraints
Solution Approach 1:
The patent segments the classification task by dividing entities into different classes (e.g., benign, malware, spam) and assigning specialized classification engines to each class. This segmentation allows the system to use multiple engines for specific entity types while avoiding unnecessary engine execution for other types, thereby maintaining detection accuracy for targeted classes while improving overall real-time performance.
Solution Approach 2:
The patent implements partial action by selectively applying classification engines based on entity characteristics. Instead of running all available engines for every entity, the system applies only the subset of engines relevant to the specific entity class, achieving sufficient detection accuracy without the overhead of exhaustive engine execution across all entities.
2Measurement precision
If multiple classification engines are used to enhance detection capability, then precision is improved, but resource consumption increases
Solution Approach 1:
The patent segments the classification workload by entity class and assigns specialized engines only to relevant segments. This ensures that computational resources are consumed only when necessary for specific entity types, reducing overall resource usage while maintaining high precision for the segmented classes where multiple engines are applied.
Solution Approach 2:
The patent applies local quality by tailoring the classification engine selection to the specific characteristics of each entity class. Different regions of the input space (entity classes) receive different levels of processing intensity, with resource-intensive multiple engine application applied locally only where it provides the most value, rather than uniformly across all entities.
3Productivity
If the best single classification engine is selected from a set, then performance is optimized, but detection accuracy may be compromised compared to using multiple engines
Solution Approach 1:
The patent implements a dynamic engine selection mechanism that adapts the number and type of classification engines applied based on entity characteristics. The system dynamically determines whether to use a single best engine or multiple specialized engines for each entity class, optimizing the balance between performance and detection accuracy according to the specific processing context rather than using a static configuration.
Solution Approach 2:
The patent changes the parameter of engine selection strategy based on entity class parameters. By adjusting which engines are applied and how many are used according to the detected entity type, the system optimizes performance for each class while maintaining overall high detection accuracy through parameter-driven engine selection rather than fixed single-engine or multi-engine approaches.
Data Source
AI summary
Architecture that selects a classification engine based on the expertise of the engine to process a given entity (e.g., a file). Selection of an engine is based on a probability that the engine will detect an unknown entity classification using properties of the entity. One or more of the highest ranked engines are activated in order to achieve the desired performance. A statistical, performance-light module is employed to skip or select several performance-demanding processes. Methods and algorithms are utilized for learning based on matching the best classification engine(s) to detect the entity class based on the entity properties. A user selection option is provided for specifying a maximum number of ranked, classification engines to consider for each state of the machine. A user can also select the minimum probability of detection for a specific entity (e.g., unknown file). The best classifications are re-evaluated over time as the classification engines are updated.