Categorization Rule Selectivity Assessment for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies face inefficiencies and human errors due to the large number of heuristic rules and signatures needed for malware detection, leading to false activations and a burden on developers, as current systems struggle to cover the variety of files encountered by users.
Innovation Solution
A system and method for assessing the selectivity of categorization rules using a computer with a processor, data storage, and input/output facilities, including a categorization rule application engine, selectivity determination engine, and algorithm training engine, which applies rules to un-categorized objects, gathers statistical information, and calculates a numerical selectivity score to evaluate the accuracy of categorization rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a large number of heuristic rules and signatures are created for malware detection, then detection coverage is improved, but false activations increase
Solution Approach 1:
The system performs preliminary selectivity assessment of detection rules against a representative file collection before deploying them to end users. This advance evaluation identifies rules with high false activation potential, allowing them to be refined or discarded before causing harm in production environments.
Solution Approach 2:
The system implements a feedback loop where detection rules are evaluated against a comprehensive file collection, and the results (selectivity scores) are used to determine whether rules should be deployed, modified, or rejected. This feedback mechanism continuously improves rule quality by learning from past performance data.
2Measurement precision
If manual analysis of detection rule feedback is performed by developers, then rule accuracy can be improved, but developer burden and human errors increase
Solution Approach 1:
The system enables automated self-assessment of detection rules by applying them to a representative file collection and automatically calculating selectivity scores. This eliminates the need for manual developer analysis, reducing human burden and associated errors while maintaining high measurement precision through systematic automated evaluation.
Solution Approach 2:
The system replaces manual developer analysis with an automated mechanical evaluation process. The selectivity determination engine automatically applies detection rules to file collections and computes selectivity metrics, substituting human cognitive work with systematic computational processes that are more consistent and scalable.
3Measurement precision
If a representative collection of safe files is used for rule testing, then rule selectivity can be assessed, but the collection cannot cover the entire variety of files encountered by users
Solution Approach 1:
The system creates a multi-functional file collection that serves both as a testing environment for rule selectivity assessment and as a representative model of real-world user files. By carefully curating diverse file types and characteristics, the collection achieves universal applicability for evaluating different detection rules across various file categories.
Solution Approach 2:
The system performs preliminary construction of a comprehensive file collection that anticipates the variety of files users will encounter. This advance preparation ensures the collection includes representative samples across multiple file types, categories, and characteristics, enabling robust rule evaluation before deployment.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Assessment of selectivity of categorization rules. One or more categorization rules are applied to a set of un-categorized objects to produce a categorization result set representing assignment of the set of objects into at least two categories. A selectivity score for the at least one categorization rule is obtained based on statistical information. The numerical selectivity score represents an estimation of accuracy of the at least one categorization rule, and is produced as a result of application of at least one trained selectivity determination algorithm, which is based on application of a plurality of specially-selected categorization rules to a set of pre-categorized training data, with the application of each one producing a uniform grouping of objects.