Recurrent Neural Network for Obfuscated Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods face challenges in detecting obfuscated code, particularly in software scripts, as obfuscation techniques can vary and are difficult to distinguish from non-obfuscated code, leading to inefficiencies in identifying malicious scripts.
Innovation Solution
A deep learning model utilizing a recurrent neural network (RNN) with a bi-directional long short-term memory (LSTM) network and convolutional layers is employed to generate an index representation of code characters, identify features, and classify sequences, effectively distinguishing between obfuscated and non-obfuscated code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods (entropy, TF-IDF) are used to detect obfuscated code, then the detection process is simple and fast, but the accuracy and recall are low
Solution Approach 1:
The patent replaces traditional mechanical detection methods (entropy calculation, TF-IDF analysis) with a neural network-based system that uses embedding layers, convolutional layers, and LSTM layers to automatically learn and detect code features, thereby improving detection accuracy while maintaining reasonable system complexity
Solution Approach 2:
The neural network system performs self-learning and automatic feature extraction from code sequences without requiring manual feature engineering or predefined detection rules, enabling the system to adapt to various obfuscation techniques autonomously
2Reliability
If complex obfuscation techniques are used by malware, then the malicious code becomes harder to detect, but the detection accuracy of traditional methods decreases
Solution Approach 1:
The patent transforms code into numerical sequences through embedding layers, converting textual code features into numerical vectors that can be processed by the neural network, thereby enabling effective detection of obfuscated code through learned patterns in the numerical representations
Solution Approach 2:
The patent uses multiple layers (embedding layer, convolutional layers, LSTM layers) to analyze code from different dimensional perspectives, extracting features at multiple levels of abstraction and combining them to improve detection reliability against complex obfuscation techniques
3Productivity
If manual analysis of obfuscated code is performed, then detailed inspection is possible, but the productivity and efficiency are low
Solution Approach 1:
The neural network system automatically performs feature extraction, sequence detection, and classification without requiring manual analysis, achieving both high productivity through automation and high precision through learned patterns from training data
Solution Approach 2:
The system uses trained neural network models that have learned from labeled training data, incorporating feedback from training examples to improve detection accuracy while maintaining high processing speed for production use
Data Source
AI summary
A method includes generating an index representation of characters of code of a given file and mapping the index representation to a vector space providing contextual representation of the characters utilizing an embedding layer of a recurrent neural network (RNN). The method also includes identifying one or more code features in the mapped index representation utilizing at least one hidden layer of the RNN, detecting sequences of the identified code features in the mapped index representation utilizing a plurality of memory units of a recurrent layer of the RNN, and generating a classification result for the given file based on the detected sequences of code features utilizing one or more classification layers of the RNN. The method further comprises utilizing the classification result to determine if the given file contains code of a designated code type, and modifying access by a given client device to the given file responsive to the determination.