Runtime Malware Detection via Image Feature Space
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques face challenges in identifying evolving malware that employs behavior modification and evasion techniques, such as compression and obfuscation, making it difficult to define generic signatures based on static or dynamic analysis.
Innovation Solution
The method involves using deep convolutional neural networks to transform sample execution behavior into an image equivalent feature space, generating image matrices to represent system processes and sequences, and training models to predict malware likelihood, allowing for real-time detection of complex and occluded patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep convolutional neural networks are used to transform behavior into image equivalent feature space, then malware detection precision is improved, but device complexity increases
Solution Approach 1:
The patent replaces traditional malware analysis mechanisms (static analysis, dynamic analysis, heuristic analysis) with a deep convolutional neural network-based image processing system. The system transforms malware behavior data into image equivalent feature space, allowing the use of成熟的image processing algorithms and deep learning models to detect malware patterns that were previously difficult to identify using conventional methods.
Solution Approach 2:
The patent fundamentally changes the parameter space by transforming malware behavior characteristics into an image equivalent feature space with different dimensional parameters. Instead of analyzing raw behavior logs or system calls directly, the system converts these into visual representations where spatial relationships and patterns become detectable, enabling the application of image processing techniques to malware detection.
2Productivity
If real-time malware detection is implemented, then productivity is improved, but use of energy increases
Solution Approach 1:
The patent performs preliminary actions by pre-processing malware behavior data into image equivalent feature space representations before actual detection occurs. The system captures and transforms behavior patterns during execution, creating ready-to-analyze visual representations that can be quickly processed by trained deep learning models, reducing the computational burden during real-time detection phases.
Solution Approach 2:
The patent creates simplified copies of malware behavior in the form of image equivalent feature space representations. Instead of analyzing the complete and complex raw behavior data, the system generates condensed visual representations that capture essential patterns while reducing data volume, enabling faster and more energy-efficient analysis by deep learning models.
3Adaptability or versatility
If compression and obfuscation techniques are used by malware, then malware adaptability is improved, but malware detection precision deteriorates
Solution Approach 1:
The patent addresses malware adaptability by dynamically capturing malware behavior during actual execution rather than relying on static analysis. The system monitors system calls, API invocations, and runtime behaviors, transforming these dynamic characteristics into image representations. This approach detects malware based on what it actually does during execution, making compression and obfuscation techniques less effective since the detection is based on behavioral patterns rather than code structure.
Data Source
AI summary
A method for runtime malware detection is described. In one embodiment, the method may include classifying a first file as clean and a second file as malware, performing a sample execution of the first and second files, identifying system processes called during sample executions of the first and second files, mapping each system process of the host operating system to a position on an image matrix, indicating each system process called during the sample execution of the first file in a first image matrix and each system process called during the sample execution of the second file in a second image matrix, and determining at runtime a probability an unknown file includes malware based at least in part on an analysis of the unknown file in relation to at least one of the first instance and the second instance of the generated image matrix.