Accelerated Malware Emulation via Native Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods face challenges in identifying new threats and are computationally intensive, as content-based methods struggle with unknown malware and behavior-based methods require long analysis times.
Innovation Solution
The system employs an accelerated emulation of untrusted computer files in a virtual environment, using native-code acceleration routines to execute known code sequences, thereby determining malware presence efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior-based methods are used to detect new malware threats, then detection capability for unknown threats is improved, but computational intensity and analysis time increase
Solution Approach 1:
The patent segments the malware detection process into two distinct phases: a fast content-based scanning phase that handles known signatures, and a slower behavior-based emulation phase that analyzes unknown threats. This segmentation allows the system to quickly filter out known malware while reserving computational resources for analyzing unknown threats only when necessary, thereby reducing overall analysis time while maintaining detection capability for both known and unknown threats.
Solution Approach 2:
The patent applies partial action by executing only the necessary behavior-based emulation analysis for code sequences that are not recognized by content-based scanning. Instead of subjecting all code to full behavior analysis, the system performs content scanning first and only executes the more intensive emulation for unrecognizable sequences, reducing computational intensity while maintaining thorough analysis where needed.
2Productivity
If content-based scanning is used to identify known malware, then speed of identification is improved, but ability to detect new threats deteriorates
Solution Approach 1:
The patent implements preliminary action through a two-stage detection process where content-based scanning is performed first as a preliminary filter. This fast scanning phase quickly identifies and filters out known malware signatures, allowing the system to proceed to more thorough behavior-based analysis only for code that passes the preliminary screen, thereby maintaining both speed for known threats and capability for new threats.
Solution Approach 2:
The patent introduces an intermediary behavior-based emulation layer that sits between the content-based scanning and the final detection decision. This intermediary phase analyzes the behavioral characteristics of code sequences that were not identified by content scanning, serving as a mediator that bridges the gap between fast known-threat detection and thorough unknown-threat analysis.
3Reliability
If full behavior-based emulation is performed on all code sequences, then detection accuracy is improved, but computational resource consumption increases
Solution Approach 1:
The patent applies local quality by differentiating the detection approach based on the characteristics of each code sequence. Content-based scanning is applied locally to all code for quick filtering, while behavior-based emulation is applied locally only to code sequences that are not recognized by content scanning. This localized application of resources ensures high detection accuracy for unknown threats while minimizing overall computational consumption by avoiding redundant analysis of known patterns.
Data Source
AI summary
In some embodiments, antivirus/malware behavior-based scanning (emulation) is accelerated by identifying known code sequences and executing pre-stored native-code routines (e.g. decompression, decryption, checksum routines) implementing the functionality of the known code sequences before returning to the emulation. During emulation, target machine code instructions are compared to a set of known signatures. If a known code sequence is identified, the emulator calls a native code routine and caches the current instruction address. If the emulator subsequently reaches a cached address, a native code routine may be called without scanning the data at the address for known signatures. Signature scanning may be performed selectively for instructions following code flow changes (e.g. after jump, call or interrupt instructions). The emulator may also call native-code routines implementing virtual operating system calls, and native-code unpacked file reconstruction routines that reconstruct unpacked files from the contents of virtual memory for scanning by a content-based malware scanner.