Two-Stage File Classification for Malicious Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus technologies, including machine learning-based two-stage file classification models, face challenges in accurately distinguishing malicious files from trusted and untrusted files due to superficial classification and high computational costs, leading to errors in detection.
Innovation Solution
A two-stage file classification method using a hardware processor to select attributes, calculate a flexible hash, and choose a classifier based on the hash value, assigning files to categories with a focus on minimizing false positives and using supervised learning to verify candidate classifiers, thereby improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If simple classification models are used, then computational cost is reduced, but detection quality deteriorates
Solution Approach 1:
The patent divides the classification process into two distinct stages: a fast rough classification stage that quickly filters files into broad categories, and a more detailed verification stage that applies only to files requiring deeper analysis. This segmentation allows the system to achieve high detection quality for critical cases while maintaining overall computational efficiency through the rapid initial filtering.
Solution Approach 2:
The patent applies the partial action principle by performing comprehensive analysis only on files that pass through the rough classification filter and meet certain criteria, rather than applying full analysis to all files. This selective approach ensures high detection quality for suspicious files while avoiding unnecessary computational expenditure on obviously benign files.
2Measurement precision
If complex two-stage classification models are used, then detection quality is improved, but computational expense increases
Solution Approach 1:
The patent segments the classification workload into a lightweight rough classification phase using simple attributes and a more intensive verification phase. This segmentation ensures that complex computational operations are performed only when necessary, thereby improving detection quality for critical cases while controlling overall computational expense through the efficiency of the initial filtering stage.
3Speed
If rough classification is used, then processing speed is improved, but classification accuracy deteriorates
Solution Approach 1:
The patent implements a two-stage classification system where the first stage performs rapid rough classification to filter the majority of files quickly, and the second stage provides detailed verification for files that require higher accuracy. This segmentation allows the system to achieve high processing speed for the bulk of files while ensuring high classification accuracy for files that pass through the initial filter.
Solution Approach 2:
The rough classification stage acts as an intermediary between rapid processing and accurate classification. It provides a quick initial assessment that filters out obviously benign files, allowing the more accurate but slower verification stage to focus only on files that require detailed analysis, thereby balancing speed and accuracy.
4Measurement precision
If all possible attributes are analyzed, then detection accuracy is improved, but computing expense increases
Solution Approach 1:
The patent segments attribute analysis into two phases: the rough classification phase analyzes only simple, low-cost attributes to quickly filter files, while the verification phase analyzes additional attributes only for files that require deeper inspection. This segmented approach achieves high detection accuracy for critical files while controlling overall computing expense by limiting full attribute analysis to only when necessary.
Solution Approach 2:
The patent applies partial action by analyzing the complete set of attributes only for files that pass through the rough classification filter and meet certain risk criteria, rather than analyzing all attributes for every file. This selective attribute analysis ensures high detection accuracy for suspicious files while significantly reducing overall computing expense by avoiding unnecessary full attribute analysis on benign files.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are methods and systems for detecting malicious files using two stage file classification. An exemplary method comprises selecting, by a hardware processor, a set of attributes of a file under analysis, calculating, by the hardware processor, a hash of the file based on the selected set of attributes, selecting, by the hardware processor, a classifier for the file from a set of classifiers based on the calculated hash of the file, assigning, by the hardware processor, the file under analysis to the one or more categories based on the selected classifier, determining whether the file has been assigned to a category of malicious files and concluding that the file is malicious based on the determination.