Neural Classification of Variable-Length Code for Novel Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, including signature-based approaches and artificial intelligence techniques, face challenges in identifying novel malware with variable properties, often failing to detect malicious code with unknown signatures, and require constant updates to remain effective.
Innovation Solution
A machine learning system that uses a neural network with convolutional and recurrent layers to analyze variable-length source data, extracting features and embedding them into a fixed-dimensional representation for efficient classification, allowing for the detection of malware and adware, even in executable and non-executable formats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then known malware can be identified, but newly created malware with unknown signatures cannot be detected
Solution Approach 1:
The patent transforms the detection approach from signature-based to property-based analysis. Instead of matching fixed signatures, the system analyzes variable properties of malware (such as code structure, behavior patterns, and statistical features) that can be quantified and compared. This allows the system to detect both known and novel malware by identifying suspicious property patterns rather than relying on pre-defined signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a neural network-based analytical system. The neural network learns to identify malware by analyzing property patterns and relationships, substituting the rigid mechanical approach of signature comparison with an adaptive intelligent system that can generalize to unknown malware types.
2Productivity
If signature-based detection is used, then detection can be performed without constant updates, but the system provides a false sense of security against new malware
Solution Approach 1:
The patent performs preliminary analysis of malware properties and patterns during the detection process itself, rather than relying on pre-computed signatures. The neural network is trained on property data and can immediately analyze new malware based on learned patterns, eliminating the need for constant signature updates while maintaining high detection accuracy for both known and novel threats.
3Device complexity
If standard neural network approaches with fixed-length feature vectors are used, then implementation is simplified, but variable properties of malware encoded in variable number of bits escape detection
Solution Approach 1:
The patent addresses variable-length input by transforming the problem into a different dimensional space. The neural network architecture is designed to handle variable-length property sequences by embedding them into a fixed-dimensional representation, allowing the system to maintain implementation simplicity while preserving detection precision for malware with variable properties.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Example techniques described herein determine a classification of a variable-length source data such as an executable code. A neural network system that includes a convolution filter, a recurrent neural network, and a fully connected layer can be configured in a computing device to classify executable code. The neural network system can receive executable code of variable length and reduce its dimensionality by generating a variable-length sequence of features extracted from the executable code. The sequence of features is filtered, and applied to one or more recurrent neural networks and to a neural network. The output of the neural network classifies the data. Other disclosed systems include a system for reducing the dimensionality of command line input using a recurrent neural network. The reduced dimensionality of command line input may be classified using the disclosed neural network systems.