AI Malware Analysis Using Disassembly and Control Flow
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity technologies struggle to detect and analyze new or variant malware, decoy information, and advanced persistent threats (APT) effectively, lacking standardized description methods for malware and attack techniques, and are limited in predicting future cyber threats.
Innovation Solution
A cyber threat information processing apparatus and method that disassembles executable files, generates instruction sequences based on control flows, converts them into feature data sets, and uses AI models to learn and identify malware, attack techniques, and predict future threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional pattern-based detection methods are used, then detection speed and accuracy are improved for known malware, but detection capability deteriorates for new or variant malware
Solution Approach 1:
The malware analysis system segments the detection process into multiple stages: initial pattern-based filtering, followed by AI model analysis of disassembled code and control flow graphs. This segmentation allows rapid detection of known malware while enabling deep analysis of new variants through the AI component.
Solution Approach 2:
The patent introduces an AI model as an intermediary between conventional pattern matching and malware detection. The AI model analyzes disassembled code and control flow characteristics, bridging the gap between known patterns and unknown variants, enabling detection of new malware while maintaining the efficiency of pattern-based methods.
2Adaptability or versatility
If AI analysis is used to detect and analyze malware, then adaptability to new threats is improved, but detection speed and reliability deteriorate due to lack of standardized methods
Solution Approach 1:
The patent standardizes the input parameters for the AI model by implementing a unified disassembly and control flow graph generation process. This standardization ensures consistent feature extraction from malware samples, improving the reliability of AI-based detection while maintaining adaptability to new threats.
Solution Approach 2:
The system implements a universal analysis framework that processes all malware samples through the same disassembly and control flow analysis pipeline. This universal approach ensures standardized, reliable detection across diverse malware types while the AI model maintains adaptability to new variants.
3Measurement precision
If disassembly and control flow analysis are performed, then identification of malware variants is improved, but processing time increases
Solution Approach 1:
The system performs preliminary pattern-based detection before initiating time-consuming disassembly and control flow analysis. This preliminary action filters out clearly identifiable malware, reserving the more time-intensive analysis methods for cases where they are truly needed, thus reducing overall processing time while maintaining high identification precision.
Solution Approach 2:
The analysis process is made dynamic by adapting the depth of disassembly and control flow analysis based on the initial pattern matching results. For suspected variant malware, the system dynamically adjusts the analysis intensity, performing more thorough disassembly only when necessary, thereby balancing identification precision with processing time.
Data Source
AI summary
Provided is a cyber threat information processing method including obtaining disassembled code by dissembling an executable file, generating an instruction sequence based on a control flow according to a relationship between instructions in the disassembled code, converting the generated instruction sequence into a feature data set related to a cyber threat, and acquiring cyber threat information by learning the feature data set using an artificial intelligence (AI) model.