Behavioral Malware Detection via Benign Application Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods face challenges in identifying malicious software that masquerades as benign applications or hides within valid ones, especially when malware injects code or modifies applications to evade behavioral analysis.
Innovation Solution
A behavioral analysis approach is implemented by creating profiles for known benign applications, monitoring system behavior, and detecting deviations from expected actions to identify malicious or suspicious applications, using characteristic and expected actions to differentiate between legitimate and compromised applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If behavioural analysis techniques examine calls to external libraries or API calls to detect malware, then detection capability is improved, but sophisticated malware can inject code from external libraries along with malicious code to remove the need for such calls and evade detection
Solution Approach 1:
The system performs preliminary action by establishing a behaviour profile for benign applications before malware can infect them. The profile captures the expected sequence of operations and API calls that a legitimate application performs, creating a baseline for future comparison. This allows the system to detect deviations caused by malware injection even when the malicious code attempts to hide by removing or modifying external library calls.
2Measurement precision
If security applications monitor and analyse the behaviour of running applications to detect malware, then detection accuracy is improved, but malware can modify benign applications to add instructions that execute malicious code when run, making it harder to distinguish from legitimate behaviour
Solution Approach 1:
The system uses feedback by continuously monitoring the actual behaviour of running applications and comparing it against the pre-established behaviour profile. When deviations are detected—such as unexpected API calls, incorrect operation sequences, or unusual behaviour patterns—the system can identify the application as compromised. This feedback mechanism allows detection of malware that has modified benign applications, as the malicious instructions will cause the application to behave differently from its legitimate counterpart.
3Object-affected harmful factors
If code injection attacks exploit incorrect validation of inputs to cause benign applications to execute malicious instructions, then attack effectiveness is improved, but the application's behaviour will deviate from its expected procedure and can be detected
Solution Approach 1:
The system performs preliminary action by establishing a behaviour profile for benign applications before malware can infect them. The profile captures the expected sequence of operations and API calls that a legitimate application performs, creating a baseline for future comparison. This allows the system to detect deviations caused by malware injection even when the malicious code attempts to hide by removing or modifying external library calls.
Data Source
AI summary
A method of detecting malware present on a computer system. A set of applications is predefined as benign, and profiles are provided for respective benign applications. Each profile identifies one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions. Behavior of the computer system is monitored to detect performance, by a running application, of a characteristic action of a procedure of a benign application. Upon detection of performance of a characteristic action, the profile provided for the associated benign application is used to detect a deviation from the expected actions of the procedure; and the detection of a deviation is used to identify the running application as malicious or suspicious.