Software Clustering Graphs for Malware Concept Drift Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques fail to account for concept drift due to time-series changes, leading to reduced detection accuracy over time, especially when new malware families emerge.
Innovation Solution
A generation device that acquires software information, extracts feature quantities, generates clusters with center of gravity calculations, matches clustering results, and creates a graph to detect concept drift, facilitating accurate malware detection by updating machine learning models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware detection uses traditional machine learning models trained on historical data, then detection accuracy is maintained for known malware families, but detection accuracy deteriorates over time when new malware families emerge due to concept drift
Solution Approach 1:
The system continuously monitors clustering results and compares them with historical clustering data to detect concept drift. When drift is detected, the system triggers re-learning of the machine learning model, creating a feedback loop that maintains detection accuracy over time by adapting to new malware families while preserving knowledge of previous families
Solution Approach 2:
The system performs preliminary clustering analysis on new malware data before full detection to detect concept drift early. By calculating clustering results and comparing them with historical data in advance, the system can identify when new malware families emerge and trigger model re-learning before detection accuracy deteriorates
2Adaptability or versatility
If the machine learning model is continuously re-trained to adapt to new malware, then detection accuracy for new malware families is improved, but computational resources and time are increased
Solution Approach 1:
The system uses feedback from clustering analysis to determine when re-learning is necessary. By continuously monitoring whether new malware clusters match historical patterns, the system triggers re-learning only when concept drift is detected, avoiding unnecessary re-training and optimizing the balance between adaptability and time consumption
Solution Approach 2:
The system performs self-diagnosis through clustering analysis to detect concept drift automatically. The clustering module independently analyzes new malware data and determines whether re-learning is needed, enabling the system to self-regulate its adaptability without external intervention and minimizing unnecessary computational overhead
Data Source
AI summary
A generation device includes generation circuitry configured to acquire information on software, extract a feature quantity of the software from the information of the software acquired, generate a cluster for each software on the basis of the feature quantity extracted, calculate a clustering result including a center of gravity of the cluster, match the clustering result calculated with the past clustering result when a distance between a center of gravity of a cluster included in the past clustering result calculated from information on malware is equal to or less than a predetermined value, and generate a graph representing a relationship between the software and the malware on the basis of a result of matching.