Assembly Code CTI Analysis for Variant Malware Identification

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing cybersecurity technologies struggle to detect and respond to new or variant malware, decoy information, and advanced persistent threats (APT) effectively, lacking standardized methods for describing malware and attack techniques, and failing to identify attackers accurately.

Innovation Solution

A cyber threat information processing apparatus and method utilizing natural language processing to analyze cyber threat information, enabling detection of non-matching malware, identifying attack techniques and attackers, and predicting future threats through machine learning and AI-based analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional pattern-based detection methods are used, then detection speed and accuracy are improved for known malware, but detection capability is lost for new or variant malware without established patterns

Engineering Contradiction:
Improvedetection accuracyVSAvoiddetection capability for new malware
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The malware analysis system segments the detection process into multiple independent modules: static analysis module for code structure examination, dynamic analysis module for behavioral observation, and AI-based analysis module for pattern recognition. Each module handles specific aspects of malware detection, allowing the system to maintain high accuracy for known malware while adapting to new variants through different analysis approaches.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system implements dynamic analysis capabilities that observe malware behavior in real-time execution environments rather than relying solely on static code patterns. This allows the system to adapt to new malware variants by detecting their actual runtime behavior, even when their code structure differs from known patterns. The dynamic analysis environment can be reconfigured to accommodate different malware types.

Inventive Principle:
Principle #15Dynamics

2Productivity

If AI-based malware analysis is implemented, then analysis capability is improved, but fundamental technology to counter new cyber threats is still lacking

Engineering Contradiction:
Improveanalysis capabilityVSAvoideffectiveness against new threats
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The system performs preliminary analysis actions by creating a comprehensive database of malware patterns, behavioral characteristics, and attack techniques before encountering new threats. This pre-established knowledge base enables the AI to quickly analyze and respond to new malware variants by comparing them against known patterns and behaviors, improving both productivity and reliability simultaneously.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where analysis results from detected malware are continuously fed back into the AI model to improve future detection accuracy. When new malware variants are detected, their characteristics are added to the training database, allowing the system to learn and adapt. This closed-loop feedback ensures that AI-based analysis becomes progressively more effective against emerging threats.

Inventive Principle:
Principle #23Feedback

3Adaptability or versatility

If standardized methods for describing malware and attack techniques are not implemented, then flexibility in analysis is maintained, but confusion occurs in identifying and responding to threats

Engineering Contradiction:
Improveanalysis flexibilityVSAvoidthreat identification clarity
Core Design Contradiction:
Adaptability or versatilityVSLoss of information

Solution Approach 1:

The system implements a universal standardized framework that can describe and categorize diverse malware types and attack techniques using common terminology and classification schemes. This standardized framework enables consistent identification and response to threats across different analysis contexts while maintaining the flexibility to accommodate various malware variants through the same unified interface.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentUS20260030355A1Cyber threat information processing apparatus, cyber threat information processing method, and storage medium storing cyber threat information processing program
Publication Date: 2026.01.29 SANDS LAB INC
  • US20260030355A1 patent drawing
  • US20260030355A1 patent drawing
  • US20260030355A1 patent drawing

AI summary

Provided is a cyber threat information processing method including receiving a CTI analysis request for assembly code from a client; analyzing the assembly code to obtain analysis information of the CTI for the assembly code; generating a CTI query related to a file based on the analyzed CTI and delivering the CTI query to a natural language model; and providing natural language description information according to the CTI query obtained from the CTI for the assembly code and the natural language model.