Behavioral Scanning for Obfuscated Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies are ineffective in detecting malicious programs obfuscated within packed programs, as they rely on digital signatures that need updating for each unique variation, allowing malware to evade detection until signature databases are updated.
Innovation Solution
A computer-implemented method and system that executes a packed program, monitors its behavior, detects suspicious activities indicating unpacking and execution of obfuscated malicious code, and performs security operations, including scanning memory for malware signatures based on specified criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing antivirus technologies use digital signature detection, then known malware can be identified, but packed programs with obfuscated malicious code cannot be detected until signature databases are updated
Solution Approach 1:
The system performs preliminary actions by executing the packed program in a controlled environment to trigger the unpacking process before actual detection occurs. This preliminary execution reveals the hidden malicious code, allowing the system to obtain signatures in advance and detect the malware before it can cause harm in production environments.
Solution Approach 2:
A sandbox environment acts as an intermediary between the packed program and the detection system. The sandbox safely executes the program, captures its behavior and unpacked code, and provides this information to the detection system without exposing the host system to risks. This intermediary layer enables detection of obfuscated malware while maintaining system safety.
2Adaptability or versatility
If malware authors create unique variations of malicious programs through packing, then malware can evade detection, but security systems must continuously update signature databases to keep pace
Solution Approach 1:
The system implements feedback by monitoring the execution behavior of packed programs and using this information to dynamically update detection capabilities. When new packing techniques or obfuscation methods are detected during execution analysis, the system learns from these patterns and adapts its detection rules, reducing reliance on manual signature database updates.
Solution Approach 2:
The patent replaces the mechanical approach of manually updating signature databases with an automated behavioral analysis system. Instead of relying on periodic manual updates of static signatures, the system uses dynamic execution monitoring and automated pattern recognition to detect malware variations, significantly reducing the complexity of maintaining detection capabilities against evolving threats.
3Difficulty of detecting and measuring
If packed programs are executed to reveal malicious code, then detection becomes possible, but the execution process may cause harmful effects before detection occurs
Solution Approach 1:
The system applies beforehand cushioning by implementing comprehensive protective measures before executing packed programs. These include isolation mechanisms, resource constraints, and safety protocols that prevent the unpacked malicious code from causing significant harm even if execution proceeds. This cushioning allows the system to safely reveal obfuscated code for detection while minimizing potential damage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for scanning packed programs in response to detecting suspicious behaviors may include (1) executing a packed program that may include (i) malicious code that has been obfuscated within the packed program and (ii) unpacking code that deobfuscates and executes the malicious code when the packed program is executed, (2) monitoring, while the packed program is executing, how the packed program behaves, (3) detecting, while monitoring how the packed program behaves, a suspicious behavior of the malicious code that indicates that the unpacking code has deobfuscated and executed the malicious code, and (4) performing a security operation on the packed program in response to detecting the suspicious behavior of the malicious code. Various other methods, systems, and computer-readable media are also disclosed.