Binary Control Flow Graph Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to detect software anomalies and malware in binary code without source code or execution, making it difficult to identify patterns indicative of cybersecurity issues.
Innovation Solution
A system and method that receive machine-readable binary code and a control flow pattern, identifying execution paths and transmitting signals indicating the presence of library function calls, using a processor to parse executable binary code and generate signals for malware detection based on predefined patterns without executing the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If binary code is analyzed without source code or execution, then detection capability is improved, but interpretation difficulty increases
Solution Approach 1:
The patent introduces control flow graphs as an intermediary representation between binary code and analysis. The binary code is first converted into a control flow graph that preserves execution paths and function call relationships, making it easier to analyze patterns without needing source code or executing the binary. This intermediary structure enables reliable detection while reducing interpretation difficulty.
Solution Approach 2:
The patent creates a symbolic copy of the binary code's control flow structure through control flow graphs and call graphs. Instead of directly analyzing the opaque binary instructions, the system generates a symbolic representation that captures the essential execution paths and function call patterns, enabling pattern matching and anomaly detection without executing the original code.
2Reliability
If static analysis is performed on binary code to detect patterns, then security detection is improved, but analysis complexity increases
Solution Approach 1:
The patent segments the binary code analysis into distinct components: control flow graph construction, call graph generation, and pattern matching. By dividing the analysis process into these separate stages, each handling a specific aspect of the binary code structure, the system achieves comprehensive security detection while managing complexity through modular processing.
Solution Approach 2:
The patent replaces traditional dynamic analysis methods (execution-based) with static analysis using control flow graphs. Instead of mechanically executing the binary code to detect patterns, the system uses graph-based representations and algorithmic pattern matching, substituting physical execution with computational analysis of structural relationships.
3Measurement precision
If control flow patterns are identified in binary code, then malware detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary construction of control flow graphs and call graphs from the binary code before pattern matching begins. By pre-processing the binary code into structured graphical representations that capture all execution paths and function calls, the system enables faster and more accurate pattern detection during the actual malware analysis phase, reducing overall processing time while maintaining high accuracy.
Data Source
AI summary
A method includes receiving, at a processor, (1) machine-readable binary code to be executed at a target processor and (2) a machine-readable control flow pattern that includes one or more library function calls. The method also includes identifying, via the processor, an indication of an execution path in the machine-readable binary code based on the machine-readable control flow pattern. The method also includes transmitting, via the processor, a signal that indicates that the machine-readable binary code includes the one or more library function calls included in the machine-readable control flow pattern.