Similarity Space Mapping for Manipulated File Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing similarity spaces are vulnerable to false positive and false negative results when malicious actors manipulate files by altering or renaming them to evade detection, as they rely on a single set of features for adjudication, leading to inaccurate classification.
Innovation Solution
Construct multiple similarity spaces based on different sets of features (low-level, high-level, and behavioral sequence features) and create mappings between these spaces to locate files accurately, using Approximate Nearest Neighbors models for fast querying and provide human-readable descriptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single similarity space is used for file classification, then the system is simple and fast, but it produces false positives and false negatives when files are manipulated to evade detection
Solution Approach 1:
The patent divides the single similarity space into multiple distinct similarity spaces, each specialized for detecting different types of file features (e.g., structural features, behavioral features, semantic features). This segmentation allows each space to focus on specific detection tasks, improving overall reliability while maintaining manageable complexity through modular organization
Solution Approach 2:
The patent creates a universal file classification system where multiple similarity spaces work together to perform comprehensive file analysis. Each similarity space serves multiple purposes: detecting malicious files, classifying file types, and identifying manipulation techniques. This multi-functionality approach improves detection accuracy across diverse file scenarios without proportionally increasing system complexity
2Measurement precision
If multiple similarity spaces are constructed to improve detection accuracy, then false positives and negatives are reduced, but the system complexity and computational overhead increase
Solution Approach 1:
The patent introduces multiple dimensional perspectives for file analysis by creating distinct similarity spaces that evaluate files from different feature dimensions (structural, behavioral, semantic). This dimensional expansion allows the system to capture complex file characteristics that cannot be detected from a single perspective, improving measurement precision while organizing complexity across multiple independent dimensions
Solution Approach 2:
The patent employs intermediary mechanisms such as feature extraction modules and similarity computation algorithms that bridge the multiple similarity spaces. These intermediaries process raw file data and transform it into comparable representations across different spaces, enabling accurate cross-space comparison without directly managing the full complexity of multiple independent analysis systems
Data Source
AI summary
A method for selecting a region of a similarity space in which to locate a file. Numerous files are received, and feature vectors for each of the received files is created, each feature vector comprising values representing corresponding features for the file. A respective similarity space is created for each of the respective number of feature vectors, each respective similarity space comprising several regions. One of the regions of the respective similarity space is selected in which a respective representation of each file is located based on the respective feature vector for the file. A map of relationships between one or more regions of the similarity spaces is then constructed.