Application Phenotyping for Polymorphic Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are ineffective against polymorphic malware and zero-day attacks, as they rely on signature-based approaches that fail to detect changes in malicious code, and are overly restrictive, making it difficult to differentiate between normal and malicious behavior in dynamic environments.
Innovation Solution
The implementation of an application phenotyping framework that uses 'microsteps' to characterize normal application behaviors, allowing for content-agnostic detection by comparing the behavior of processes against stored phenotypes, thereby identifying deviations from known good behaviors and flagging potentially malicious actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based malware detection is used, then detection of known malware is achieved, but detection of polymorphic and zero-day malware fails
Solution Approach 1:
Instead of detecting malware by matching its signature, the patent inverts the approach by detecting what is normal behavior and flagging deviations. The system builds phenotypes of legitimate applications representing their normal operational patterns, then identifies malware by detecting behaviors that deviate from these established phenotypes, thereby solving the problem of detecting unknown and polymorphic malware variants.
Solution Approach 2:
The patent transitions from static signature parameters to dynamic behavioral parameters. Rather than relying on fixed code signatures that malware can evade, the system monitors dynamic behavioral parameters such as system calls, file operations, and process interactions, allowing detection of malware based on anomalous behavior patterns regardless of its code form.
2Reliability
If whitelisting approach is used, then system protection against approved software is achieved, but the system becomes overly restrictive and difficult to customize
Solution Approach 1:
The patent transforms the static whitelisting approach into a dynamic system. Instead of maintaining a fixed list of approved applications with binary allow/block rules, the system continuously learns and adapts application behaviors through phenotype building. This dynamic approach allows the system to automatically adjust to new legitimate applications and user preferences without requiring manual configuration, thereby maintaining protection effectiveness while improving flexibility.
Solution Approach 2:
The system implements self-service by automatically building phenotypes of applications as they execute, without requiring manual administrator intervention. The phenotype building process occurs autonomously in the background, allowing the system to adapt to new legitimate software automatically, thus reducing operational complexity while maintaining security effectiveness.
3Ease of manufacture
If binary allow/block rules are implemented, then simple malware blocking is achieved, but differentiation between normal and malicious behavior in dynamic environments becomes difficult
Solution Approach 1:
The patent segments application behavior into discrete, analyzable components called phenotypes. Each phenotype represents a specific aspect of normal application behavior (e.g., file access patterns, system call sequences). This segmentation allows the system to maintain simple detection rules while achieving precise behavioral analysis by evaluating multiple segmented behavioral dimensions rather than relying on single binary decisions.
Data Source
AI summary
A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide “content-less” malware detection, i.e., detecting a process as being an ‘anomaly’ not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) ‘trusted’ application behaviors, i.e., the trusted applications' “phenotypes” and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., “application phenotypes”)—and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a “good” application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.