System Call Vectorization for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems in network environments face overwhelming data transmission and misclassification issues due to the sheer volume of system calls generated by processes, which hinders effective malware detection.
Innovation Solution
The system employs count vectors generated from aggregated system calls over predefined time intervals, reducing data transmission while preserving essential information, and utilizes a machine learning-based malware detection module to classify processes as malicious or benign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all system calls are transmitted to the malware detection system, then detection completeness is improved, but network bandwidth is overwhelmed
Solution Approach 1:
The patent extracts only the essential features from the complete system call data by generating count vectors that tally the frequency of each system call type. This extraction process removes redundant information while preserving the critical patterns needed for malware detection, thereby reducing data transmission volume without sacrificing detection completeness.
Solution Approach 2:
The patent transforms the raw system call data into a different parameter representation - count vectors that capture the frequency distribution of system call types. This parameter transformation reduces the data dimensionality from individual system call sequences to aggregated frequency counts, enabling efficient network transmission while maintaining detection accuracy.
2Quantity of substance
If system calls are filtered to reduce transmission, then network bandwidth is preserved, but malware classification accuracy deteriorates
Solution Approach 1:
The patent merges multiple individual system call observations into aggregated count vectors that combine frequency information across different system calls. This merging process preserves the essential behavioral patterns of malware while reducing data volume, as the combined frequency distribution maintains discriminative power for accurate malware classification.
Solution Approach 2:
The count vector serves as an intermediary representation between raw system calls and malware classification. This intermediate structure preserves critical information about system call frequency patterns while filtering out redundant details, enabling accurate malware detection with reduced data transmission.
3Quantity of substance
If count vectors are used to reduce data, then network efficiency is improved, but information loss may occur
Solution Approach 1:
The patent extracts the essential informational content from system calls by computing frequency counts for each system call type. This extraction process removes redundant sequential details while preserving the core behavioral characteristics that are most informative for malware detection, thereby minimizing information loss relative to the reduction in data volume.
Data Source
AI summary
The systems and methods that detect malware from count vectors are provided. A count vector having multiple components is generated. The count vector tracks a number and types of system calls generated by a process. Each component in the count vector is mapped to a type of a system call that exists in an operating system. Multiple system calls generated by the process are received over a first time interval. Each system call is mapped to a component in the count vector. The count vectors are aggregated according to a second time interval into a vector packet. The vector packet is transmitted over a network to a malware detection system that uses the count vectors in the vector packet to determine whether the process is a malware process.