Wavelet Decomposition of Software Entropy for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated malware authors conceal malicious commands in portable executable files through encryption and compression, making them difficult to detect using traditional methods.
Innovation Solution
The use of wavelet decomposition of software entropy to generate an energy spectrum, which is then analyzed using predictive models like logistic regression to determine the likelihood of a file being malicious, even if it contains encrypted or compressed segments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used on encrypted or compressed malware, then the detection process is simple, but the detection accuracy is low
Solution Approach 1:
The patent segments the malware file into multiple chunks and calculates entropy for each chunk individually. This segmentation allows the system to analyze different portions of the file separately, capturing localized entropy patterns that indicate malware presence even when the overall file is encrypted or compressed. The wavelet transform further segments the entropy signal into different frequency components, enabling multi-scale analysis.
Solution Approach 2:
The patent introduces entropy calculation and wavelet transform as intermediary processing steps between the raw malware file and the final detection decision. These intermediaries transform the encrypted/compressed binary data into an entropy time series, which then undergoes wavelet decomposition to produce coefficients that serve as features for the classifier. This intermediary processing chain enables accurate detection without requiring decryption or decompression of the malware.
2Difficulty of detecting and measuring
If malware is encrypted or compressed to conceal commands, then the malware becomes harder to detect, but the file structure becomes more complex
Solution Approach 1:
The patent changes the parameter being analyzed from the raw binary content of the file to the entropy of file chunks. This parameter transformation converts the problem of detecting encrypted/compressed malware into detecting abnormal entropy patterns. The wavelet transform then changes the parameter representation again, decomposing the entropy signal into frequency-domain coefficients that reveal structural anomalies indicative of malware regardless of encryption or compression applied to the original file.
3Measurement precision
If wavelet decomposition is applied to entropy time series, then the predictive accuracy improves to 68.7%, but the processing complexity increases
Solution Approach 1:
The patent applies dynamic wavelet transform, which adaptively selects wavelet basis functions and decomposition levels based on the characteristics of the entropy time series. This dynamic approach allows the processing complexity to adjust according to the specific file being analyzed, achieving high predictive accuracy of 68.7% while avoiding unnecessary computational overhead for simpler cases. The dynamic nature of the wavelet decomposition enables the system to capture relevant features at appropriate scales without uniformly applying maximum processing to all files.
Data Source
AI summary
A plurality of data files is received. Thereafter, each file is represented as an entropy time series that reflects an amount of entropy across locations in code for such file. A wavelet transform is applied, for each file, to the corresponding entropy time series to generate an energy spectrum characterizing, for the file, an amount of entropic energy at multiple scales of code resolution. It can then be determined, for each file, whether or not the file is likely to be malicious based on the energy spectrum. Related apparatus, systems, techniques and articles are also described.