Anti-malware Stalling Code Detection via Loop Exit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic analysis of malware in sandboxes is vulnerable to stalling codes, which execute long loops to induce timeouts, preventing effective evaluation of malware.
Innovation Solution
The method involves suspending the execution of a sample program, setting breakpoints on timing operations, identifying loops, and modifying the execution flow to exit stalling code blocks, allowing the program to continue without getting stuck in time-consuming loops.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is performed in a sandbox by running and monitoring malware behavior, then malware detection capability is improved, but the analysis becomes vulnerable to stalling codes that execute long loops to induce timeouts
Solution Approach 1:
The patent applies preliminary action by inserting instrumentation code into the malware execution environment before the stalling loop can complete. This instrumentation monitors timing operations and detects loops that exceed expected execution time, allowing the system to intervene and terminate the analysis before the timeout occurs, thus preventing the loss of time while maintaining detection capability
Solution Approach 2:
The patent implements feedback by continuously monitoring the execution time and behavior of the malware during dynamic analysis. When the feedback indicates that a timing operation is taking longer than expected or that a loop is repeating beyond normal parameters, the system responds by terminating the analysis, thereby preventing timeout while preserving the ability to detect malware that uses stalling codes
2Measurement precision
If breakpoints are set on timing operations to detect stalling code, then detection accuracy is improved, but device complexity increases due to additional monitoring and evaluation mechanisms
Solution Approach 1:
The patent applies segmentation by dividing the detection task into distinct components: instrumentation code insertion, breakpoint setting on timing operations, loop detection, and termination logic. This modular approach improves detection accuracy by systematically monitoring each aspect while managing complexity through organized, separate functional blocks rather than a monolithic system
Solution Approach 2:
The patent uses an intermediary approach by introducing instrumentation code as a mediator between the malware execution and the analysis system. This intermediary layer monitors timing operations and provides structured feedback about loop behavior, improving detection precision while keeping the core analysis system relatively simple by offloading complex monitoring tasks to the intermediary instrumentation layer
Data Source
AI summary
Execution of a sample program being evaluated for malware is initiated and then suspended to set breakpoints on timing operations of the sample program. Execution of the sample program is suspended again when a breakpoint is hit, at which time a loop is identified in the sample program and evaluated for presence of stalling code. Execution flow of the sample program is changed to exit the loop when the loop is determined to include the stalling code.