Executable File Analysis via Basic Block Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus products face challenges in detecting and decrypting polymorphic viruses due to their ability to change encryption algorithms and keys, leading to slow emulation techniques that are not suitable for real-time use, especially with large files containing millions of instructions.
Innovation Solution
The method involves partitioning executable files into basic blocks of code, translating and linking these blocks for faster execution, and using cache memory to enhance processing speed, allowing for real-time decryption and analysis of malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If emulation techniques are used to decrypt polymorphic viruses, then the decryption capability is improved, but the processing speed deteriorates to the point where real-time analysis becomes impossible
Solution Approach 1:
The patent segments the executable file into basic blocks of code and processes them individually. By dividing the large file (2MB or more with 200 million instructions) into smaller basic blocks, the system can translate and execute them efficiently, achieving processing speeds of up to 100 million instructions per second while maintaining complete decryption capability.
Solution Approach 2:
The patent performs preliminary translation of basic blocks into translated basic blocks before execution. This preliminary action creates a mapping between original instructions and translated code, allowing the system to quickly execute decrypted code without repeating the translation process, thereby achieving real-time processing speeds.
2Measurement precision
If conventional emulation is used on large polymorphic viruses, then complete analysis is achieved, but the processing time increases to 20 seconds to 1 minute or more
Solution Approach 1:
The patent introduces a virtual machine as an intermediary between the original encrypted code and the analysis system. The virtual machine executes translated basic blocks in a controlled environment, enabling complete analysis of malware behavior while maintaining processing speeds suitable for real-time use through efficient translation and execution mechanisms.
Solution Approach 2:
The patent changes the execution parameters by translating code from the original instruction set to a virtual machine instruction set. This parameter transformation allows the system to execute code more efficiently while maintaining complete analytical capability, reducing processing time from 20-60 seconds to under 1 second for files with 200 million instructions.
3Productivity
If anti-virus products ignore large files over 1 MB, then processing speed is maintained, but security coverage deteriorates allowing polymorphic viruses to evade detection
Solution Approach 1:
The patent implements a dynamic processing system that adapts to file size and complexity. Rather than statically ignoring large files, the system dynamically translates and executes basic blocks of any size, adjusting the translation and execution process based on the specific characteristics of each file. This enables real-time processing of large polymorphic viruses while maintaining complete security coverage.
Data Source
AI summary
In one aspect, an executable computer file is partitioned into basic blocks of code. At least some basic blocks are translated into translated basic blocks. At least some translated basic blocks are linked in memory of a computer. At least some translated basic blocks on the computer are executed so as to enable the file to be unpacked or decrypted. In this way, the file can be analyzed to determine whether the file is or should be classed as malware. In another aspect, at least a read page of cache memory is created for at least some basic blocks and at least a write page of cache memory is created for at least some basic blocks. During the execution of a basic block, at least one of the read page and the write page is checked for a cached real address corresponding to the virtual address that is being accessed for said basic block.