Two-Stage File Classification for Malicious Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current antivirus technologies, including machine learning-based two-stage file classification models, face challenges in accurately distinguishing malicious files from trusted and untrusted files due to superficial classification and high computational costs, leading to errors in detection.

Innovation Solution

A two-stage file classification method using a hardware processor to select attributes, calculate a flexible hash, and choose a classifier based on the hash value, assigning files to categories with a focus on minimizing false positives and using supervised learning to verify candidate classifiers, thereby improving detection accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If simple classification models are used, then computational cost is reduced, but detection quality deteriorates

Engineering Contradiction:
Improvecomputational efficiencyVSAvoiddetection quality
Core Design Contradiction:
ProductivityVSMeasurement precision

Solution Approach 1:

The patent divides the classification process into two distinct stages: a fast rough classification stage that quickly filters files into broad categories, and a more detailed verification stage that applies only to files requiring deeper analysis. This segmentation allows the system to achieve high detection quality for critical cases while maintaining overall computational efficiency through the rapid initial filtering.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies the partial action principle by performing comprehensive analysis only on files that pass through the rough classification filter and meet certain criteria, rather than applying full analysis to all files. This selective approach ensures high detection quality for suspicious files while avoiding unnecessary computational expenditure on obviously benign files.

Inventive Principle:
Principle #16Partial or excessive action

2Measurement precision

If complex two-stage classification models are used, then detection quality is improved, but computational expense increases

Engineering Contradiction:
Improvedetection qualityVSAvoidcomputational efficiency
Core Design Contradiction:
Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the classification workload into a lightweight rough classification phase using simple attributes and a more intensive verification phase. This segmentation ensures that complex computational operations are performed only when necessary, thereby improving detection quality for critical cases while controlling overall computational expense through the efficiency of the initial filtering stage.

Inventive Principle:
Principle #1Segmentation

3Speed

If rough classification is used, then processing speed is improved, but classification accuracy deteriorates

Engineering Contradiction:
Improveprocessing speedVSAvoidclassification accuracy
Core Design Contradiction:
SpeedVSMeasurement precision

Solution Approach 1:

The patent implements a two-stage classification system where the first stage performs rapid rough classification to filter the majority of files quickly, and the second stage provides detailed verification for files that require higher accuracy. This segmentation allows the system to achieve high processing speed for the bulk of files while ensuring high classification accuracy for files that pass through the initial filter.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The rough classification stage acts as an intermediary between rapid processing and accurate classification. It provides a quick initial assessment that filters out obviously benign files, allowing the more accurate but slower verification stage to focus only on files that require detailed analysis, thereby balancing speed and accuracy.

Inventive Principle:
Principle #24Intermediary (Mediator)

4Measurement precision

If all possible attributes are analyzed, then detection accuracy is improved, but computing expense increases

Engineering Contradiction:
Improvedetection accuracyVSAvoidcomputing expense
Core Design Contradiction:
Measurement precisionVSUse of energy by stationary object

Solution Approach 1:

The patent segments attribute analysis into two phases: the rough classification phase analyzes only simple, low-cost attributes to quickly filter files, while the verification phase analyzes additional attributes only for files that require deeper inspection. This segmented approach achieves high detection accuracy for critical files while controlling overall computing expense by limiting full attribute analysis to only when necessary.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies partial action by analyzing the complete set of attributes only for files that pass through the rough classification filter and meet certain risk criteria, rather than analyzing all attributes for every file. This selective attribute analysis ensures high detection accuracy for suspicious files while significantly reducing overall computing expense by avoiding unnecessary full attribute analysis on benign files.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP3588349B1System and method for detecting malicious files using two-stage file classification
Publication Date: 2022.03.30 AO KASPERSKY LAB
  • EP3588349B1 patent drawingFigure 1
  • EP3588349B1 patent drawingFigure 2
  • EP3588349B1 patent drawingFigure 3

AI summary

Disclosed herein are methods and systems for detecting malicious files using two stage file classification. An exemplary method comprises selecting, by a hardware processor, a set of attributes of a file under analysis, calculating, by the hardware processor, a hash of the file based on the selected set of attributes, selecting, by the hardware processor, a classifier for the file from a set of classifiers based on the calculated hash of the file, assigning, by the hardware processor, the file under analysis to the one or more categories based on the selected classifier, determining whether the file has been assigned to a category of malicious files and concluding that the file is malicious based on the determination.