Antivirus Record Generation via API Call Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus systems have low effectiveness in detecting malicious files, particularly polymorphic viruses and obfuscated files, due to limitations in signature analysis and the potential for malicious files to harm systems before detection by behavioral analyzers.
Innovation Solution
A system and method for creating antivirus records by analyzing API function call logs for malicious behavior, extracting relevant records, and generating antivirus records that can be registered by a computing device's protector, even if the device initially lacks support for certain records, by adding support when necessary and focusing on supported records if the threshold is met.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature analysis is used for detecting malicious files, then the detection process is simple and fast, but the effectiveness is low particularly for polymorphic viruses and obfuscated files
Solution Approach 1:
The detection system is divided into multiple independent modules: signature analysis module for fast initial filtering, sandbox module for isolated behavioral execution, and behavioral analyzer module for detailed API call analysis. Each module handles specific detection tasks, allowing the system to maintain both speed (through signature filtering) and reliability (through behavioral analysis) without requiring all files to undergo complete behavioral analysis
Solution Approach 2:
The system performs preliminary signature analysis on all files before subjecting them to more resource-intensive behavioral analysis in the sandbox. This preliminary filtering action identifies obviously malicious files quickly while allowing potentially malicious but obfuscated files to proceed to deeper analysis, optimizing both detection speed and effectiveness
2Reliability
If behavioral analysis in sandbox is performed to improve detection effectiveness, then more malicious behavior can be detected, but the execution time is limited and some malicious functionals may not be discovered
Solution Approach 1:
The sandbox execution time is made dynamic rather than fixed. The system monitors file behavior during execution and extends or terminates execution based on detected behavior patterns. For files showing suspicious activity, the system can extend execution time to observe additional malicious functionals, while for benign files, execution is terminated early to save resources
Solution Approach 2:
The behavioral analyzer acts as an intermediary between the sandbox execution and final detection verdict. It continuously monitors API function calls during sandbox execution, analyzes patterns in real-time, and can trigger extended execution or immediate detection without waiting for the sandbox timeout, thereby improving detection completeness while managing execution time
3Reliability
If the behavioral analyzer monitors all API function calls to improve detection accuracy, then more malicious behavior is detected, but the complexity of analyzing call logs increases
Solution Approach 1:
The system extracts and focuses analysis on specific high-risk API function calls rather than analyzing all API calls equally. Based on predefined risk profiles and behavioral patterns, the system identifies and extracts only the most relevant API calls for detailed analysis, filtering out routine or benign calls to reduce analysis complexity while maintaining detection accuracy
Solution Approach 2:
Different levels of analysis depth are applied to different parts of the call log based on their suspiciousness. High-risk API calls (e.g., file system modifications, registry changes, network connections) receive detailed contextual analysis, while low-risk calls receive minimal or no analysis. This localized quality approach maintains detection accuracy for critical threats while reducing overall system complexity
4Reliability
If antivirus records are created only after complete analysis to ensure accuracy, then detection reliability is improved, but the time required to create protection records increases
Solution Approach 1:
The system creates preliminary antivirus records based on signature analysis and initial sandbox results before complete behavioral analysis is finished. These preliminary records provide immediate protection against obviously malicious files, while the system continues background analysis to refine and update the records with additional behavioral information, thereby reducing protection delay while maintaining accuracy
Solution Approach 2:
The system implements continuous feedback loops where preliminary antivirus records are deployed and monitored, and subsequent analysis results feed back to update and refine these records. This allows the system to provide protection based on available information while continuously improving record accuracy through ongoing analysis, balancing speed and reliability
Data Source
AI summary
Disclosed are systems and methods for creating antivirus records for antivirus applications. An exemplary method includes: analyzing a log of records of API function calls of a file for presence of malicious behavior using one or more behavioral rules; determining that the file is malicious when a behavioral rule corresponding to one or more records of API function calls from the log is identified; extracting from the log the one or more API function calls associated with the identified behavioral rule; determining whether the one or more extracted records of API function calls are supported by an antivirus application of a user device; and when the one or more extracted records of API function calls are not supported by the antivirus application, adding to the antivirus application, a support for registering the unsupported records of API function calls.