Malicious Code Detection via Behavior Vector Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malicious program detection technologies face challenges in identifying new malicious programs and variants, as they rely on character string signatures, which are time-consuming and power-intensive, and do not effectively address other vulnerabilities, leading to potential damage and inefficiencies in mobile devices.
Innovation Solution
An apparatus and method that generates behavior vectors based on program behavior signatures to diagnose malicious code by comparing them with stored vectors from known malicious and normal programs, allowing for more accurate detection without requiring information about new malicious programs, thus reducing damage and power consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If character string signature extraction and verification is used for malicious program detection, then detection capability for known malicious programs is improved, but power consumption increases and detection time increases
Solution Approach 1:
The patent extracts only the essential behavioral characteristics of programs (such as system call sequences, API invocation patterns, and control flow features) to create compact behavior signatures, rather than analyzing entire character strings. This extraction of key behavioral features enables effective malicious program detection while significantly reducing the computational resources and power consumption required for analysis.
Solution Approach 2:
The system performs preliminary classification of programs by analyzing their behavioral patterns and categorizing them into normal or malicious behavior profiles before detailed inspection. This preliminary action allows the system to quickly identify suspicious programs that require deeper analysis while avoiding exhaustive examination of benign programs, thereby reducing overall power consumption and detection time.
2Measurement precision
If character string signature databases are continuously updated to detect new malicious programs, then detection accuracy is improved, but detection time increases and power consumption increases
Solution Approach 1:
The patent implements a dynamic behavior analysis system that adapts to new malicious programs by learning from observed behavioral patterns in real-time. Instead of relying on static character string databases that require continuous updates, the system dynamically adjusts its detection models based on newly encountered program behaviors, maintaining high detection accuracy without requiring frequent database updates or increasing detection time.
Solution Approach 2:
The system changes the fundamental parameters of detection from character string matching to behavioral parameter analysis. By monitoring changes in program behavior parameters (such as execution flow patterns, system call frequencies, and resource access behaviors) rather than comparing static text signatures, the system achieves accurate detection of new malicious programs without requiring updates to signature databases, thereby reducing detection time and power consumption.
3Adaptability or versatility
If multiple character strings are used to detect variants of malicious programs, then detection coverage is improved, but device complexity increases and power consumption increases
Solution Approach 1:
The patent creates a universal behavior analysis framework that can detect multiple variants of malicious programs using a single unified approach. By analyzing fundamental behavioral patterns (such as unauthorized file modifications, abnormal process spawning, and suspicious network communications) that are common across different malicious program variants, the system achieves broad detection coverage without requiring separate detection mechanisms for each variant, thereby reducing system complexity and power consumption.
Solution Approach 2:
The system transitions from one-dimensional character string matching to multi-dimensional behavioral analysis by examining programs across multiple behavioral dimensions simultaneously (execution patterns, system interactions, resource usage, temporal characteristics). This dimensional expansion enables the detection of diverse malicious program variants through a single comprehensive analysis framework, improving detection coverage while avoiding the complexity of maintaining multiple separate detection systems.
Data Source
AI summary
An apparatus and method of diagnosing whether a computer program executed in a computer system is a malicious program and more particularly, an apparatus and method of diagnosing whether a computer program is a malicious program using a behavior of a computer program, and an apparatus and method of generating malicious code diagnostic data is provided. The apparatus for diagnosing a malicious code may include a behavior vector generation unit which generates a first behavior vector based on a behavior signature extracted from a diagnostic target program; a diagnostic data storage unit which stores a plurality of second behavior vectors for a plurality of sample programs predetermined to be malicious or normal; and a code diagnostic unit which diagnoses whether the diagnostic target program is a malicious code by comparing the first behavior vector with the plurality of second behavior vectors.