Malicious Program Detection via API Call Logic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious programs are inefficient and costly due to the need for manual testing, which slows down the detection process and lacks accuracy.
Innovation Solution
The method involves obtaining and analyzing the call logic of specific APIs within an application program to determine if it is malicious by identifying triggering events and feedback paths, matching the call logic with pre-stored logic models, and determining the presence of functions that access private information or consume resources without authorization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual testing is used to identify malicious programs, then measurement precision is improved, but productivity deteriorates
Solution Approach 1:
The patent creates a virtual copy of the runtime environment (virtual machine) to execute and observe the behavior of application programs. This virtual copy allows automated analysis of API call sequences without requiring physical manual testing, thereby maintaining detection accuracy while significantly improving testing speed and productivity.
Solution Approach 2:
The patent replaces the mechanical manual testing process with an automated system that uses virtual machine execution and algorithmic analysis of API call sequences. This substitution eliminates the need for human operators to manually trigger and observe each function, thereby increasing productivity while preserving detection precision through systematic automated analysis.
2Measurement precision
If manual testing is used to identify malicious programs, then measurement precision is improved, but loss of time worsens
Solution Approach 1:
The patent performs preliminary extraction and organization of API call sequences from the virtual machine execution before the actual malicious code detection analysis. This preliminary action prepares the data in advance, allowing the detection algorithm to work efficiently with pre-processed information, thereby reducing the overall time required for detection while maintaining accuracy.
Solution Approach 2:
By creating a virtual copy of the execution environment and capturing API call sequences during virtual execution, the system preserves the detailed behavioral data needed for accurate detection while eliminating the time-consuming nature of manual testing. The virtual copy allows rapid repeated analysis without additional time loss.
3Productivity
If automated API call analysis is used, then productivity is improved, but device complexity worsens
Solution Approach 1:
The patent segments the malicious code detection system into distinct functional modules: a virtual machine for execution, an extraction module for API call sequences, and an analysis module for detecting malicious patterns. This segmentation allows each component to perform its specific function efficiently, improving overall productivity while managing complexity through modular design that can be developed and maintained independently.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Various embodiments provide methods, apparatus, and computer readable medium for determining a malicious program. In an exemplary method, a specific application programming interface (API) within an application program can be obtained (101). Call logic for calling the specific API can be determined (102). The call logic can include a triggering event to trigger the specific API to be called, a feedback path provided after the specific API is called, or a combination thereof. Whether the application program is a malicious program can be determined (103) according to the call logic.