Static Anomaly Detection for Malware Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in identifying evolving malware instances and predicting characteristics of future malware, as they often require executing applications to determine maliciousness, which can be risky and inefficient.
Innovation Solution
A method that detects anomalous files by generating anomaly scores based on their dissimilarity to a sample of clean files, using a model trained on clean file metadata, allowing for classification and remediation without executing the files, thus preventing potential malware threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware detection systems execute applications to determine maliciousness, then detection accuracy is improved, but system safety deteriorates due to risk of executing malicious code
Solution Approach 1:
The patent uses static analysis to create a copy or representation of the malware's behavior and characteristics without executing the actual malicious code. By analyzing metadata, file structure, and static features, the system generates anomaly scores that indicate maliciousness without requiring runtime execution, thus maintaining detection accuracy while ensuring system safety.
Solution Approach 2:
The patent replaces the mechanical execution-based detection method with a static analysis-based anomaly scoring system. Instead of dynamically running applications to observe malicious behavior, the system uses machine learning models trained on static features to predict maliciousness, substituting physical execution with computational analysis of file characteristics.
2Measurement precision
If malware detection systems manually create detection rules, then detection precision is improved for known malware, but adaptability deteriorates for evolving malware instances
Solution Approach 1:
The patent implements a dynamic anomaly scoring system using machine learning models that continuously adapt to new malware patterns. Instead of static manual rules, the system uses trained models that can generalize to unseen malware variants by learning from training data, allowing the detection mechanism to evolve and adapt as malware techniques change over time.
Solution Approach 2:
The patent changes the detection parameters from fixed manual rules to flexible anomaly scores generated by machine learning models. The system evaluates multiple features and metadata parameters simultaneously, weighting them based on learned patterns rather than predetermined thresholds, enabling the system to adapt to diverse and evolving malware characteristics.
3Difficulty of detecting and measuring
If malware detection systems execute applications for analysis, then detection capability is improved, but resource consumption deteriorates
Solution Approach 1:
The patent extracts essential detection capabilities from the execution process by analyzing only the static metadata and file characteristics. By taking out the necessary information (file headers, metadata, structural features) and analyzing these without full execution, the system maintains detection capability while significantly reducing computational resources and energy consumption compared to running complete application executions.
Data Source
AI summary
A protection application detects and remediates malicious files on a client. The protection application trains models using known samples of static clean files, and the models characterize features of the clean files. A model may be selected based on metadata obtained from a target file. By processing features of the clean files and features of the target file, the model may generate an anomaly score indicating a level of dissimilarity between the target file and the sample. The protection application compares the anomaly score to one or more threshold scores to classify the target file. Additionally, the target file may be provided to a security server to check against a whitelist or blacklist for classification. Responsive to a classification as malicious, the protection application remediates the target file on the client.