Malware Detection via System API Function Pointer Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors use sophisticated techniques to pack and obfuscate malicious code, making it difficult for existing detection methods to identify and detect malware effectively.
Innovation Solution
The proposed solution involves scanning process memory for dynamically generated function pointers, specifically system API function pointers, to detect and identify malware. This approach includes monitoring changes in memory during malware execution, generating an API vector from identified function pointers, and using this vector to automatically generate signatures for malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware code is packed and obfuscated to evade detection, then malware can bypass firewalls and security software, but detection precision deteriorates making it difficult to identify malicious software
Solution Approach 1:
The patent applies dynamics by transitioning from static signature-based detection to dynamic behavior analysis. The system monitors runtime function pointer resolutions and API calls, capturing the dynamic execution behavior of malware regardless of its packed or obfuscated state. This allows detection of malware based on what it does rather than how it looks, resolving the contradiction between evasion capability and detection precision.
Solution Approach 2:
The patent changes the 'color' or representation of malware from its original binary form to a behavioral fingerprint based on function pointer patterns. By analyzing the sequence and nature of API calls made during execution, the system creates a new identification signature that is independent of the malware's obfuscation, effectively changing how malware is detected from structural to behavioral characteristics.
2Reliability
If sophisticated packing and obfuscation techniques are used by malware authors, then malware can avoid detection by existing security systems, but this increases the complexity of malware analysis and detection systems required to counter it
Solution Approach 1:
The patent extracts the essential behavioral characteristics of malware by focusing specifically on function pointer resolution patterns and API call sequences. Rather than analyzing the entire complex malware binary or its obfuscation techniques, the system extracts and monitors the critical execution behavior that remains consistent across different packed and obfuscated versions, simplifying the detection approach while maintaining effectiveness.
3Productivity
If traditional signature-based detection methods are used, then known malware can be detected efficiently, but obfuscated and packed malware variants cannot be detected
Solution Approach 1:
The patent performs preliminary action by establishing a baseline of normal function pointer patterns and API call sequences before malware execution. The system pre-configures monitoring points and expected behavioral patterns, allowing it to quickly compare actual malware behavior against known good patterns during execution, maintaining efficiency while improving detection of obfuscated variants.
Data Source
AI summary
Techniques for identifying malware based on system API function pointers are disclosed. In some embodiments, a system/process/computer program product for identifying malware based on system API function pointers includes monitoring changes in memory during execution of a malware sample in a computing environment; detecting a dynamic evasion behavior using an Application Programming Interface (API) vector comprising a plurality of system API function pointers identified in the memory during execution of the malware sample in the computing environment; and generating a signature based on the API vector for automatically detecting the malware during execution in the memory, wherein the malware sample was determined to be malicious.