Two-Stage File Classification for Malicious Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies face challenges in accurately detecting malicious files due to superficial classification methods that fail to consider similarities within the same file class, leading to errors in detection.
Innovation Solution
A two-stage file classification system that selects attributes, calculates a flexible hash for similarity preservation, and chooses a classifier based on the hash to categorize files into malicious, trusted, or untrusted categories, minimizing false positives and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If simple classifying models are used to detect malicious files, then the detection process is fast and computationally inexpensive, but the detection accuracy is low and fails to consider similarities within the same file class
Solution Approach 1:
The patent divides the classification process into two distinct stages: a rough classification stage that quickly categorizes files into broad groups, and a detailed classification stage that applies specialized classifiers to each group. This segmentation allows the system to achieve high detection accuracy by considering similarities within file classes while maintaining computational efficiency through the staged approach.
Solution Approach 2:
The patent implements a dynamic classification system where the level of analysis adapts based on the file's characteristics and the classification stage. The system transitions from a simple rough classification to more complex detailed classification only when necessary, optimizing the balance between detection accuracy and computational resources.
2Reliability
If complex classifying models are used to improve detection accuracy, then the quality of malicious file detection increases, but the computational expenses and processing time increase significantly
Solution Approach 1:
The patent segments the classification workload into two stages: a lightweight rough classification that consumes minimal computational resources, and a more resource-intensive detailed classification that is applied only to specific file groups. This segmentation ensures that high detection quality is achieved while controlling overall computational expenses.
Solution Approach 2:
The patent applies complex detailed classification only partially - specifically, only to files that pass through the rough classification stage and require more nuanced analysis. This partial application of complex models reduces overall computational expenses while maintaining high detection quality where it is most needed.
3Productivity
If rough classification is used to quickly categorize files, then processing speed is high, but the classification is superficial and fails to differentiate between similar files in the same class
Solution Approach 1:
The patent segments classification into two sequential stages: rough classification that maintains high processing speed by using simple criteria, and detailed classification that improves precision by analyzing similarities within file classes. The segmentation ensures that speed is maintained in the first stage while precision is enhanced in the second stage.
Solution Approach 2:
The patent performs preliminary rough classification first to quickly sort files into broad categories, then applies detailed classification as a follow-up action only where needed. This preliminary action approach maintains high overall processing speed while improving classification precision for files that require it.
Data Source
AI summary
Disclosed herein are methods and systems for detecting malicious files using two stage file classification. An exemplary method comprises selecting, by a hardware processor, a set of attributes of a file under analysis, calculating, by the hardware processor, a hash of the file based on the selected set of attributes, selecting, by the hardware processor, a classifier for the file from a set of classifiers based on the calculated hash of the file, assigning, by the hardware processor, the file under analysis to the one or more categories based on the selected classifier, determining whether the file has been assigned to a category of malicious files and concluding that the file is malicious based on the determination.