Antivirus Checking Native Images Parent Assembly
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The growing number of software applications and exponentially increasing files created by them pose a challenge in categorizing unique files, particularly native images of .NET assemblies, which are complex due to their metadata and machine code structure, making conventional file categorization methods inefficient.
Innovation Solution
A system and method for antivirus checking of native images involve identifying the parent assembly used to create the image, comparing metadata elements such as CIL code, PE file headers, and CLR headers, and using templates to determine correspondence and categorize images, ensuring accurate identification of malicious images.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional file categorization methods are used on native images, then the process becomes inefficient and difficult, but the files still need to be categorized for security analysis
Solution Approach 1:
The patent introduces parent assemblies as intermediary objects to facilitate the categorization of native images. Instead of directly analyzing complex native images, the system uses parent assemblies as mediators that contain the original source code and metadata, making the categorization process more efficient and manageable.
Solution Approach 2:
The patent segments the antivirus checking process into two distinct parts: checking parent assemblies and checking native images. This segmentation allows the system to handle each type of file with appropriate methods, improving overall efficiency by not applying the same complex analysis to both file types.
2Measurement precision
If detailed analysis of native image contents is performed to categorize unique files, then categorization accuracy improves, but the time and computational resources required increase significantly
Solution Approach 1:
The patent performs preliminary analysis on parent assemblies before native images are created. By categorizing and analyzing the parent assembly in advance, the system prepares the necessary security information beforehand, so that when the native image is created, the categorization is already known or can be quickly inferred, reducing the time needed for detailed analysis.
Solution Approach 2:
The system creates and analyzes parent assemblies as copies or source representations of the code that will be compiled into native images. By working with the parent assembly copy that contains readable source code and metadata, the system can perform detailed analysis more efficiently than analyzing the compiled binary native image directly.
3Reliability
If antivirus checking is performed on all native images individually, then security coverage is comprehensive, but the computational overhead and processing time increase
Solution Approach 1:
The patent merges the security checking process by associating native images with their parent assemblies. Instead of treating each native image as an independent entity requiring full antivirus analysis, the system combines the checking process with the parent assembly verification, so that one security check can validate both the source code and the compiled output.
Solution Approach 2:
The parent assembly serves multiple functions: it is both the source code repository and the security reference for its generated native images. By making the parent assembly multi-functional, the system reduces redundant security checks, as the same parent assembly validation applies to all native images derived from it.
Data Source
Figure 1A~1B
Figure 1C
Figure 2
AI summary
Disclosed is a system and method for antivirus checking of native images of software assemblies. An example method includes for detecting malicious native images of a machine code, the method comprising: receiving a native image of the machine code; identifying a parent assembly, which was used to create the native image; determining whether the parent assembly corresponds to the machine code; and determining that the native image is malicious when the parent assembly does not correspond to the machine code.