Neural Classification of Variable-Length Code for Novel Malware Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current malware detection methods, including signature-based approaches and artificial intelligence techniques, face challenges in identifying novel malware with variable properties, often failing to detect malicious code with unknown signatures, and require constant updates to remain effective.

Innovation Solution

A machine learning system that uses a neural network with convolutional and recurrent layers to analyze variable-length source data, extracting features and embedding them into a fixed-dimensional representation for efficient classification, allowing for the detection of malware and adware, even in executable and non-executable formats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If signature-based malware detection is used, then known malware can be identified, but newly created malware with unknown signatures cannot be detected

Engineering Contradiction:
Improvedetection accuracyVSAvoiddetection coverage
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent transforms the detection approach from signature-based to property-based analysis. Instead of matching fixed signatures, the system analyzes variable properties of malware (such as code structure, behavior patterns, and statistical features) that can be quantified and compared. This allows the system to detect both known and novel malware by identifying suspicious property patterns rather than relying on pre-defined signatures.

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The patent replaces the mechanical signature-matching system with a neural network-based analytical system. The neural network learns to identify malware by analyzing property patterns and relationships, substituting the rigid mechanical approach of signature comparison with an adaptive intelligent system that can generalize to unknown malware types.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Productivity

If signature-based detection is used, then detection can be performed without constant updates, but the system provides a false sense of security against new malware

Engineering Contradiction:
Improvedetection speedVSAvoidsecurity assurance
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent performs preliminary analysis of malware properties and patterns during the detection process itself, rather than relying on pre-computed signatures. The neural network is trained on property data and can immediately analyze new malware based on learned patterns, eliminating the need for constant signature updates while maintaining high detection accuracy for both known and novel threats.

Inventive Principle:
Principle #10Preliminary action

3Device complexity

If standard neural network approaches with fixed-length feature vectors are used, then implementation is simplified, but variable properties of malware encoded in variable number of bits escape detection

Engineering Contradiction:
Improvesystem simplicityVSAvoiddetection precision
Core Design Contradiction:
Device complexityVSMeasurement precision

Solution Approach 1:

The patent addresses variable-length input by transforming the problem into a different dimensional space. The neural network architecture is designed to handle variable-length property sequences by embedding them into a fixed-dimensional representation, allowing the system to maintain implementation simplicity while preserving detection precision for malware with variable properties.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

Data Source

PatentEP3534283B1Classification of source data by neural network processing
Publication Date: 2022.10.19 CROWDSTRIKE
  • EP3534283B1 patent drawingFigure 1
  • EP3534283B1 patent drawingFigure 2
  • EP3534283B1 patent drawingFigure 3A

AI summary

Example techniques described herein determine a classification of a variable-length source data such as an executable code. A neural network system that includes a convolution filter, a recurrent neural network, and a fully connected layer can be configured in a computing device to classify executable code. The neural network system can receive executable code of variable length and reduce its dimensionality by generating a variable-length sequence of features extracted from the executable code. The sequence of features is filtered, and applied to one or more recurrent neural networks and to a neural network. The output of the neural network classifies the data. Other disclosed systems include a system for reducing the dimensionality of command line input using a recurrent neural network. The reduced dimensionality of command line input may be classified using the disclosed neural network systems.