Static Feature Extraction from Structured Files for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing structured files, such as Portable Executable format files, are limited in their ability to effectively extract features for identifying potentially malicious code, as they often rely on dynamic analysis or focus solely on header analysis, missing comprehensive feature extraction from all documented and undocumented fields.
Innovation Solution
A method that iteratively identifies and analyzes code and data regions within structured files, including those like PE format files, to extract first-order features, which can be transformed and processed into higher-order features, utilizing static analysis to encompass all fields, both documented and undocumented, and incorporating negative space analysis for comprehensive feature extraction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is used to extract features from structured files, then identification accuracy can be improved, but resource consumption and execution time increase significantly
Solution Approach 1:
The patent extracts specific static features from structured files such as PE headers, import tables, export tables, and section tables without executing the file. This extraction approach obtains sufficient identification features while avoiding the high resource consumption of dynamic analysis, directly resolving the contradiction between accuracy and resource usage.
Solution Approach 2:
The patent performs preliminary static analysis on file structures, headers, and metadata before any execution or dynamic analysis. By pre-extracting features from the file's static structure including undocumented fields and negative spaces, the system prepares identification data in advance, reducing the need for resource-intensive dynamic analysis while maintaining accuracy.
2Productivity
If header analysis only is performed on structured files, then analysis speed is improved, but feature extraction completeness deteriorates
Solution Approach 1:
The patent segments the structured file analysis into multiple components: header analysis, import table analysis, export table analysis, section table analysis, and negative space analysis. This segmentation allows the system to efficiently process each component separately while comprehensively extracting features from all parts of the file, resolving the contradiction between speed and completeness.
Solution Approach 2:
The patent extends analysis from the traditional single dimension of header analysis to multiple dimensions including documented fields, undocumented fields, negative spaces, and various table structures. This multi-dimensional approach comprehensively extracts features throughout the entire file structure while maintaining analysis efficiency through systematic organization.
3Measurement precision
If comprehensive feature extraction from all fields is performed, then identification accuracy is improved, but analysis complexity increases
Solution Approach 1:
The patent implements a universal static analysis framework that handles multiple file types (PE, ELF, Mach-O) and extracts features from various sections (headers, tables, sections, negative spaces) using a unified approach. This multi-functional system comprehensively extracts features while managing complexity through a standardized analysis methodology applicable across different file formats.
Solution Approach 2:
The patent introduces an intermediary processing layer that systematically organizes and extracts features from complex file structures. This intermediary layer includes modules for header parsing, table analysis, section extraction, and negative space identification, which collectively manage the complexity of comprehensive feature extraction while maintaining organization and efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, a non-transitory computer program product, and a system are provided. The method comprises receiving or accessing data comprising a structured file encapsulating data required by an execution environment to manage executable code wrapped within the structured file. The method further comprises iteratively identifying code and data regions in the structured file for parsing and disassembly; and extracting a plurality of features from the structured file based on the identifying of at least a portion of the identified code and data regions. The method further comprises truncating one of the features and generating an additional feature noting a reason for the truncation, the reason being one of the data comprising non-printable characters, invalid encodings, or a mixture of languages. The method further comprises inputting the extracted features and the additional feature into at least one machine learning model to classify the structured file as malicious or safe; and preventing access or execution of the structured file if it is classified as malicious; or accessing or executing the structured file if it is classified as safe.