Behavioral Code Profiling for Polymorphic Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions struggle to detect polymorphic malware that disguises itself by changing its signature, leading to failures in zero-day attacks and undetected malicious activities.
Innovation Solution
A system and method for profiling code execution on electronic devices using malware-access rule logic, which monitors specific entities and operations, generates notifications for unusual patterns, and determines whether these patterns indicate malware, allowing for real-time detection and corrective action without relying on signature matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching is used for malware detection, then detection of known malware is improved, but detection of polymorphic and zero-day malware deteriorates
Solution Approach 1:
The patent changes the detection parameter from static signature matching to dynamic behavioral pattern analysis. Instead of comparing fixed code signatures, the system monitors operational parameters such as file access patterns, registry modifications, and system calls to detect malware behavior, enabling detection of polymorphic and zero-day variants that lack known signatures.
Solution Approach 2:
The patent replaces the mechanical signature matching mechanism with a behavioral analysis system that observes and profiles operational patterns. This substitution allows the system to detect malware based on its actions rather than its static code structure, effectively countering polymorphic transformations.
2Adaptability or versatility
If behavioral pattern monitoring is implemented, then detection of polymorphic malware is improved, but system complexity increases
Solution Approach 1:
The patent segments the monitoring system into distinct functional modules: pattern definition modules that establish behavioral baselines, monitoring modules that capture operational data, analysis modules that compare observed behavior against patterns, and response modules that execute remediation actions. This segmentation reduces overall system complexity by making each component specialized and manageable.
Solution Approach 2:
The patent introduces behavioral patterns as an intermediary layer between the monitoring system and malware detection. These patterns serve as mediators that translate complex behavioral observations into detectable signatures, simplifying the detection process while maintaining high adaptability against zero-day threats.
3Speed
If real-time behavioral analysis is performed, then malware detection speed is improved, but computational resource consumption increases
Solution Approach 1:
The patent applies partial monitoring by focusing computational resources on specific high-risk operations and entities rather than analyzing all system activities uniformly. The behavioral patterns define subsets of operations that require intensive monitoring, allowing the system to achieve fast detection where needed while conserving resources during normal operations.
Solution Approach 2:
The patent performs preliminary action by pre-defining behavioral patterns and baselines before malware execution occurs. This advance preparation allows the real-time analysis to simply compare observed behavior against predetermined patterns, significantly reducing computational overhead during actual detection while maintaining high speed.
Data Source
Figure 1
Figure 2
Figure 2
AI summary
Technologies for securing an electronic device may include determining a plurality of rules, monitoring execution of the electronic device, generating a notification that one of the operations has occurred based upon the rules, and, based on the notification and the pattern of the operations, determining whether the operations are indicative of malware. The rules may include an identification of a plurality of entities of the electronic device to be monitored, an identification of one or more operations between the entities to be monitored, and an identification of a pattern of the operations to be monitored.