Virus Classification Model for Executable File Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software virus detection methods are inefficient in identifying new viruses and have high false positive rates, relying heavily on manual analysis and labor-intensive processes, especially when dealing with shell viruses.
Innovation Solution
An information processing method that acquires executable files, extracts operation instructions, determines feature values, constructs a virus classification model, and identifies unknown files as viruses based on structural feature parameters, reducing the need for manual intervention and improving precision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If virus feature code extraction method is used, then known viruses can be quickly and precisely identified, but new viruses cannot be identified and false positive rate is high
Solution Approach 1:
The system performs preliminary actions by constructing a virus classification model in advance using feature values from operation instructions. This model is built beforehand to enable automated classification of unknown viruses without requiring manual analysis when new viruses are detected, thus resolving the contradiction between precise identification of known viruses and ability to identify new viruses.
Solution Approach 2:
The system implements self-service by using the constructed virus classification model to automatically classify and identify viruses. The model autonomously processes executable files, extracts operation instructions, and classifies viruses based on feature values without requiring continuous manual intervention, thereby improving both identification precision and adaptability to new viruses.
2Reliability
If virus behavior detection on virtual machine is used, then virus behavior can be detected, but labor cost increases and false positive rate remains high
Solution Approach 1:
The system replaces the mechanical manual analysis process with an automated classification model. Instead of relying on analysts to manually detect virus behaviors on virtual machines, the virus classification model automatically processes executable files, extracts operation instructions, and classifies viruses based on learned feature values, thereby maintaining detection capability while dramatically improving productivity.
Solution Approach 2:
The virus classification model acts as an intermediary between the executable file and the classification result. It receives executable files, extracts operation instructions, processes feature values, and outputs classification results, thereby automating the detection process and reducing both labor cost and false positive rates while maintaining reliable virus detection capability.
3Measurement precision
If manual analysis by analyst is used, then virus identification can be performed, but labor cost greatly increases
Solution Approach 1:
The system implements self-service through the virus classification model that automatically performs virus identification without manual intervention. The model independently extracts operation instructions from executable files, processes feature values, and classifies viruses, thereby maintaining precise identification capability while eliminating the need for manual analysis and greatly improving processing efficiency.
Solution Approach 2:
The system extracts the essential classification capability from manual analysis and encapsulates it in the virus classification model. By extracting operation instructions and feature values from executable files and using them to build an automated classification system, the patent separates the identification capability from manual labor, maintaining precision while dramatically improving productivity.
Data Source
AI summary
The present disclosure discloses an information processing method, including the steps of acquiring at least one executable file of a specified type; extracting a first operation instruction from the at least one executable file of the specified type; determining the first operation instruction as a feature instruction if a preset policy is met; extracting a feature value of the feature instruction; constructing a virus classification model based on the feature value of the feature instruction for obtaining a virus structural feature parameter; extracting a second operation instruction from at least one to-be-analyzed file when the at least one to-be-analyzed file is identified according to the virus classification model; and identifying the to-be-analyzed file as a virus file if the feature value of the second operation instruction corresponds to the virus structural feature parameter.