Recurrent Neural Network Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems, particularly smartphones, face challenges in efficiently and timely detecting emerging malicious activities and vulnerabilities due to the constant evolution of threats, with traditional security measures like firewalls and antivirus programs being insufficient against new threats.
Innovation Solution
A recurrent neural network is employed to analyze sequences of computer instructions, providing outputs on the likelihood of malicious activity at multiple points within the sequence, allowing for real-time detection and blocking of potentially harmful code, thereby enhancing the detection of vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures (firewalls, antivirus programs) are used to detect malicious activity, then the system structure is simple and easy to implement, but the detection capability is insufficient against new and emerging threats
Solution Approach 1:
The patent replaces traditional mechanical security measures (firewalls, antivirus programs) with a neural network-based detection system. The neural network learns patterns of malicious activity through training data, enabling it to detect new and emerging threats that rule-based traditional systems cannot identify. This substitution transforms the detection mechanism from static rule-matching to dynamic pattern recognition.
Solution Approach 2:
The patent changes the fundamental parameters of the detection system by transitioning from discrete rule-based decisions to continuous probability outputs. The neural network provides likelihood scores for malicious activity, allowing for more nuanced detection thresholds and adaptive response strategies. This parameter change enables the system to handle uncertainty and gradations in threat assessment.
2Measurement precision
If comprehensive analysis of code sequences is performed to improve detection accuracy, then the detection precision increases, but the processing time increases
Solution Approach 1:
The patent performs preliminary analysis by evaluating code sequences at multiple intermediate points throughout the execution flow, rather than waiting until the end. This allows the system to detect malicious activity earlier in the process, reducing the effective processing time required to identify threats while maintaining comprehensive analysis coverage through the use of recurrence relations to carry forward contextual information.
3Speed
If real-time detection of malicious activity is implemented, then the response time is reduced, but the computational resources required increase
Solution Approach 1:
The patent segments the code analysis process into discrete evaluation points throughout the execution sequence. By dividing the continuous analysis into manageable segments at key instruction points, the system can perform real-time detection without requiring exhaustive analysis of every single instruction. This segmentation allows for efficient resource utilization while maintaining comprehensive monitoring capability.
Data Source
AI summary
A method of identifying malicious activity in a sequence of computer instructions includes providing the sequence of computer instructions into a recurrent neural network configured to provide an output based on both the current instruction being input and at least one prior instruction in the sequence, and evaluating the provided sequence of computer instructions in the recurrent neural network at multiple points within the sequence. An output is provided indicating whether the network has determined the code sequence to that point is likely malicious.