Staged Ensemble Classification for Malicious Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing classification systems for malicious software face challenges in balancing classification accuracy, speed, and resource costs, particularly when multiple classifiers are used in cascaded configurations, as they often require extensive computational resources and time to achieve accurate results.
Innovation Solution
A method and system that utilize a genetic algorithm to compute and adjust threshold sequences across cascaded classifiers, optimizing the flow of data between classifiers based on scores and resource usage, thereby identifying a preferred threshold sequence that balances accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple classifiers are used in cascaded configuration to improve classification accuracy, then classification accuracy is improved, but computational resources and time required for classification increase
Solution Approach 1:
The patent applies dynamics by making the classifier configuration adaptive rather than static. The genetic algorithm dynamically adjusts which classifiers are activated and in what order based on the specific input characteristics. This allows the system to use more classifiers when needed for high accuracy while using fewer classifiers when simpler cases can be resolved quickly, thus resolving the contradiction between accuracy and computational resource usage.
Solution Approach 2:
The patent changes the parameter of classifier configuration (which classifiers are used and their order) based on input characteristics. The genetic algorithm optimizes these parameters to achieve the desired balance between accuracy and computational efficiency. By varying the classifier configuration parameters rather than using a fixed cascade, the system can adapt resource usage to the actual classification needs.
2Measurement precision
If multiple classifiers are used in cascaded configuration to improve classification accuracy, then classification accuracy is improved, but classification time increases
Solution Approach 1:
The system dynamically determines the classification path through the cascade based on input characteristics. The genetic algorithm optimizes the order and selection of classifiers to minimize classification time while maintaining accuracy. This dynamic approach allows the system to potentially exit the cascade early when sufficient accuracy is achieved, reducing classification time compared to always using all classifiers.
Solution Approach 2:
The patent applies partial action by not always requiring all classifiers in the cascade to process every input. The genetic algorithm determines the optimal subset of classifiers needed for each input case, allowing partial processing when full cascade execution would be excessive. This resolves the contradiction by using only the necessary portion of the classifier cascade for each classification task.
3Measurement precision
If higher classification thresholds are used to reduce false positives, then classification accuracy is improved, but more data must flow through all classifiers increasing resource usage
Solution Approach 1:
The patent changes the threshold parameters dynamically based on input characteristics and optimization results. The genetic algorithm adjusts classification thresholds to achieve the desired balance between reducing false positives and maintaining resource efficiency. By optimizing these parameters rather than using fixed high thresholds, the system can achieve high accuracy without unnecessarily processing all data through every classifier.
Data Source
AI summary
A method for training thresholds controlling data flow in a plurality of cascaded classifiers for classifying malicious software, comprising: in each of a plurality of iterations: computing a set of scores, each for one of a set of threshold sequences, each threshold sequence is a sequence of sets of classifier output thresholds, each set of classifier output thresholds used to control a flow of data from a first cascaded classifier of the plurality of cascaded classifiers to a second cascaded classifier of the plurality of cascaded classifiers, each score computed when classifying, using the respective threshold sequence, each of a plurality of software objects as one of a set of maliciousness classes; computing a set of new threshold sequences by applying a genetic algorithm to the set of threshold sequences and the set of scores; and using the set of new threshold sequences in a consecutive iteration.