Virtual Feature Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security appliances face challenges in timely and efficient malware detection due to reactive filtering techniques that lead to high rates of false positives, wasting processing resources on benign data and failing to detect malicious combinations of features.
Innovation Solution
Implementing real-time traffic analysis using virtual features, which combine observable features with conditions derived from experiential knowledge and machine learning to assess the suspiciousness and maliciousness of data, thereby reducing false positives by performing a more tailored and directed analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reactive filtering techniques are used to match extracted features with known malware indicators, then malware detection capability is improved, but false positive rate increases and processing efficiency deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-configuring virtual features that represent malicious combinations of data characteristics before analysis occurs. These virtual features encode complex patterns of suspicious behavior that can be evaluated efficiently during real-time analysis, allowing the system to assess multiple potential threat indicators simultaneously without requiring exhaustive post-hoc investigation of each matched feature.
Solution Approach 2:
The system changes parameters by transitioning from matching individual isolated features to evaluating composite virtual features that represent combinations of data characteristics. This parameter transformation allows the system to assess the collective suspiciousness of multiple features working together, improving detection accuracy while reducing false positives through contextual evaluation rather than simple feature presence/absence checks.
2Reliability
If static analysis is configured to avoid false negatives by tagging suspicious data, then malware detection sensitivity is improved, but false positive rate increases and unnecessary dynamic analysis is performed
Solution Approach 1:
The system applies local quality by assigning different evaluation criteria and weighting to different virtual features based on their specific characteristics and the context in which they appear. Rather than applying a uniform threshold to all feature matches, the system evaluates each virtual feature combination according to its own suspiciousness profile, allowing nuanced assessment that reduces both false negatives and false positives while minimizing unnecessary dynamic analysis.
3Measurement precision
If in-depth analysis is performed on all data matching malware indicators, then detection accuracy is improved, but processing time and resource consumption increase
Solution Approach 1:
The system applies partial action by performing comprehensive evaluation only on data that matches pre-configured virtual features representing known malicious patterns. For data that does not match these virtual features, the system applies a lighter evaluation process, avoiding exhaustive analysis while maintaining high detection accuracy for actual threats. This selective approach to analysis depth optimizes the balance between detection precision and processing efficiency.
Data Source
AI summary
A non-transitory storage medium having stored thereon logic wherein the logic is executable by one or more processors to perform operations is disclosed. The operations may include parsing an object, detecting one or more features of a predefined feature set, evaluating each feature-condition pairing of a virtual feature using the one or more values observed of each of the one or more detected features, determining whether results of the evaluation of one or more feature-condition pairings satisfies terms of the virtual feature, and responsive to determining the results of the evaluation satisfy the virtual feature, performing one or more of a static analysis to determine whether the object is associated with anomalous characteristics or a dynamic analysis on the object to determine whether the object is associated with anomalous behaviors.