Trained File Classifiers for Zero-Day Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods relying on signatures struggle to keep pace with the rapid generation and distribution of new malware, often failing to detect new threats before updates are received by consumers.
Innovation Solution
The implementation of a machine learning-based file classifier that uses trained data models, such as decision trees or deep neural networks, to analyze features of files and classify them as malware or non-malware, enabling detection of unknown malware and occupying less memory than traditional signature-based systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then known malware can be detected, but new malware cannot be detected before updates are received
Solution Approach 1:
The system performs preliminary action by training machine learning models in advance on large datasets of malware and benign files before new threats emerge. The models learn patterns and features from this pre-trained knowledge, enabling them to immediately identify new malware variants without waiting for signature updates when the models are deployed.
Solution Approach 2:
The patent replaces the mechanical signature-based detection system with a machine learning-based system. Instead of relying on pre-defined signatures that require manual updates, the system uses trained neural networks or other ML models that can autonomously analyze file features and make classification decisions, substituting the rigid mechanical signature matching process with adaptive intelligent analysis.
2Adaptability or versatility
If machine learning-based classification is used, then unknown malware can be detected, but computational resources are consumed during training and inference
Solution Approach 1:
The system segments the computational process into two distinct phases: an offline training phase where the machine learning model is trained on historical data, and an online inference phase where the trained model makes rapid predictions on new files. This segmentation allows heavy computational work to be performed once during training, after which the model can operate more efficiently during actual malware detection operations.
Solution Approach 2:
The patent applies preliminary action by performing the computationally intensive model training in advance before actual detection operations. The training process analyzes vast amounts of data and learns optimal patterns, so that when the model is deployed for real-time malware detection, it can make decisions more quickly with lower computational cost, as the heavy lifting has already been done during the preliminary training phase.
3Productivity
If traditional signature-based detection is used, then system resources are consumed for storing and updating definitions, but the system cannot adapt to rapidly changing malware
Solution Approach 1:
The system introduces dynamics by replacing the static signature database with a dynamic machine learning model that can adapt to new malware patterns. The model continuously learns from new data during training and can adjust its decision boundaries and feature weights to accommodate evolving malware techniques, enabling it to adapt to rapidly changing malware variants without requiring system reconfiguration.
Solution Approach 2:
The patent applies parameter changes by training the machine learning model to detect malware based on changing patterns in file features rather than fixed signatures. The model learns from training data the statistical characteristics and patterns that distinguish malware from benign files, and these learned parameters can be adjusted through retraining on new data, allowing the system to adapt to changing malware behavior without manual signature updates.
Data Source
AI summary
A method includes receiving one or more n-gram vectors for a file as input to a file classifier, where the one or more n-gram vectors indicate occurrences of groups of entropy indicators in a sequence of entropy indicators representing the file. The method also includes generating, based on the one or more n-gram vectors, output including classification data associated with the file, the classification data indicating whether the file includes malware.