Antivirus Record Creation via API Call Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face challenges in timely detection and creation of antivirus records for malicious files, particularly due to the limitations of signature analysis and the potential for malicious files to evade detection before being executed on user computers, leading to a delay in updating protection mechanisms.
Innovation Solution
A system and method that analyze API function call logs for malicious behavior using behavioral rules, extract relevant records, and create antivirus records for computing device protectors, which can include adding support for unsupported records if necessary, to enhance detection capabilities and reduce the time required for record creation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature analysis is used for detecting malicious files, then the detection process is simple and fast, but the effectiveness is low particularly for polymorphic viruses and obfuscated files
Solution Approach 1:
The detection system is divided into multiple independent modules: signature analysis module for fast initial filtering, sandbox execution module for behavioral analysis, and record creation module for generating detection rules. Each module operates independently with its own strengths, allowing the system to maintain both speed and effectiveness.
Solution Approach 2:
The system performs preliminary signature analysis before sandbox execution to quickly eliminate obviously safe files. This preliminary filtering action reduces the number of files requiring intensive behavioral analysis, maintaining overall system efficiency while improving detection capability for suspicious files.
2Reliability
If sandbox execution is used for analyzing malicious files, then the detection effectiveness improves, but the analysis time increases significantly
Solution Approach 1:
The analysis process is segmented into two stages: fast signature-based preliminary analysis and comprehensive behavioral analysis in sandbox. Only files that fail the preliminary analysis proceed to sandbox execution, significantly reducing the average analysis time while maintaining high detection effectiveness for malicious files.
Solution Approach 2:
The system applies partial analysis (signature matching) to all files and excessive analysis (full sandbox execution) only to suspicious files. This differentiated approach ensures thorough analysis of potential threats while avoiding unnecessary time consumption on benign files.
3Reliability
If behavioral analyzer is used on user's computer for continuous monitoring, then the detection capability improves, but the system resources are consumed during file execution
Solution Approach 1:
A behavioral analyzer component is introduced as an intermediary layer between the file execution and the user's operating system. This analyzer intercepts API function calls and monitors behavior without requiring fundamental changes to the execution environment, enabling comprehensive monitoring with minimal impact on system performance.
Solution Approach 2:
The behavioral analyzer operates autonomously in the background, automatically intercepting and logging API calls without requiring user intervention or additional system resources beyond standard logging capabilities. The system serves itself by utilizing existing OS hooks and event mechanisms.
4Measurement precision
If antivirus records are created manually after detecting malicious files, then the accuracy of detection rules is high, but the time delay increases before protection is provided to users
Solution Approach 1:
The system automatically generates antivirus detection records from sandbox execution data without requiring manual analyst intervention. The record creation module extracts behavioral patterns, formulates detection rules, and integrates them into the protection system automatically, eliminating the time delay associated with manual processing while maintaining high accuracy through algorithmic analysis of execution traces.
Solution Approach 2:
The system implements a feedback loop where detection results from sandbox execution automatically trigger record creation and system updates. This closed-loop process ensures that newly detected threats are quickly converted into protective rules and distributed to users, reducing the response time while maintaining rule accuracy through iterative refinement.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods of creating antivirus records. An exemplary method comprises: analyzing, by a protector against targeted attacks, a log of API function calls of a file for presence of malicious behavior using one or more behavioral rules; determining that the file is malicious when a behavioral rule corresponding to records of a log of API function calls is identified; extracting one or more records of API function calls associated with the identified behavioral rule; determining whether at least one extracted record of the API function calls can be registered by a protector of a computing device; and when the at least one extracted record can be registered by the protector of the computing device, creating an antivirus record for the protector of the computing device, wherein the created antivirus record includes at least the extracted records of the API function calls.