Behavior Specification Units for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malware and identifying program vulnerabilities in compiled code are inadequate, as they often rely solely on functional testing and fail to scale with the complexity of machine code, and do not effectively differentiate between normal and malicious software behaviors.
Innovation Solution
A compiler-agnostic system utilizing Behavior Specification Units (BSUs) that analyze program behavior by recognizing patterns in external function calls, transforming machine code into semantic representations, and using a knowledge base to classify behaviors, thereby identifying malicious activities without decompiling the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If functional testing is used to detect malware, then testing simplicity is maintained, but detection capability deteriorates because it cannot catch many types of errors and vulnerabilities
Solution Approach 1:
The patent introduces an intermediary layer between functional testing and malware detection by creating a virtual machine environment with a customized operating system. This intermediary system captures system calls and behavior patterns, enabling comprehensive detection without requiring complex manual testing procedures. The intermediary translates functional tests into observable behavior patterns that reveal malware characteristics.
Solution Approach 2:
The patent replaces traditional mechanical functional testing with an automated behavior analysis system. Instead of manually executing tests and observing outcomes, the system automatically monitors system calls, registers, and behavior patterns in a virtualized environment. This substitution enables exhaustive testing that scales with program complexity while maintaining operational simplicity through automation.
2Measurement precision
If exhaustive testing of machine code is performed, then detection precision is improved, but testing time and complexity increase significantly
Solution Approach 1:
The patent segments the testing process into distinct phases: program execution in virtual machines, system call capture, behavior pattern identification, and malware classification. This segmentation allows each phase to be optimized independently, enabling comprehensive testing of machine code behaviors while managing time through structured analysis stages. The segmentation also permits parallel processing of multiple programs simultaneously.
Solution Approach 2:
The patent performs preliminary actions by pre-configuring virtual machine environments with customized operating systems that generate distinctive behavior patterns. These pre-configured environments are prepared in advance with known good behaviors stored as reference patterns. When testing occurs, the system compares observed behaviors against these pre-established patterns, enabling rapid identification of anomalies without requiring exhaustive re-testing of all possible scenarios.
3Speed
If compilers insert code transformations to optimize performance, then execution speed is improved, but vulnerability insertion increases making detection more difficult
Solution Approach 1:
The patent changes the parameter of code representation from compiled machine language to behavior patterns and system call sequences. By analyzing programs at the behavior level rather than the code level, the system can detect vulnerabilities introduced by compiler transformations without being confused by legitimate performance optimizations. The behavior-based approach remains invariant to code transformations while capturing the functional essence that reveals security issues.
Solution Approach 2:
The patent creates a copy of the program execution environment in virtual machines, allowing analysis of behavior patterns without modifying the original compiled code. This copying enables the system to observe how compilers transform code while maintaining the ability to detect vulnerabilities in the transformed behavior. The virtualized environment preserves all compiler insertions and transformations while providing a safe analysis platform.
4Measurement precision
If manual analysis of compiled code is performed, then analysis precision is improved, but productivity decreases due to time-consuming processes
Solution Approach 1:
The patent implements self-service by enabling the system to automatically execute programs in virtual machines, capture behavior patterns, and perform malware classification without human intervention. The automated system serves itself by processing large numbers of programs simultaneously, maintaining high analysis precision through comprehensive behavior monitoring while dramatically improving productivity through automation and parallel processing capabilities.
Data Source
AI summary
A process transforms compiled software into a semantic form. The process transforms the code into a semantic form. The process analyzes behavior functionality by processing precise programming behavior abstractions stored in a memory and classifies the code as malware based on the code behavior. Another method identifies the starting point of execution of a compiled program. The method calculates a complexity measure by calculating the number of potential execution paths of local functions; identifies the number of arguments passed to local functions; and identifies the starting point of execution of the compiled program. Another method provides interactive, dynamic visualization of a group of related functions wherein a user can explore the rendered graph and select a specific function and display functions that are color coded by their ancestral relation and their function call distance to the selected function.