Binary Decompilation for Morphed Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malware in computer systems are inadequate in identifying binary files with known malicious code without prior identification, especially when using signature matching and fail to detect morphed files with similar functionality but different physical structures, due to reliance on whole-file analysis and inability to analyze unexecuted files.
Innovation Solution
The approach involves decompiling unknown binary files and comparing their contents to known malicious code fragments through textual analysis, including decompilation, removal of comments, formatting, and identification of control structures, to detect the presence of malicious code, even in obfuscated forms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching is used to detect malware, then known malware files can be identified, but morphed files with similar functionality but different physical structures cannot be detected
Solution Approach 1:
The patent applies decompilation to convert binary malware files back into source code form, reversing the compilation process. This allows the detection system to analyze the logical structure and control flow of malware regardless of obfuscation, enabling identification of morphed files that would be invisible to traditional signature matching approaches
2Reliability
If whole file analysis is performed to calculate signatures, then complete malware identification is possible, but the process requires reading the entire file which reduces efficiency
Solution Approach 1:
The patent extracts and analyzes specific control structures and logical groups from decompiled code rather than processing the entire binary file. By focusing on key functional elements like control flow graphs and logical groupings, the system achieves reliable malware detection without the computational overhead of analyzing every byte of the file
3Difficulty of detecting and measuring
If decompilation is performed to convert binary to human-readable code, then malicious code can be identified through textual comparison, but the process complexity increases
Solution Approach 1:
The patent segments the decompiled code into logical groups of control structures (LGCS) and analyzes these structured elements rather than raw text. By organizing control flow into meaningful units and comparing logical structures, the system reduces the complexity of analyzing decompiled code while maintaining high detection accuracy
Data Source
AI summary
A system for detection of binary files containing a known malware code fragment includes a processor coupled to a memory storing instructions, the processor being configured to implement the instructions to process an unknown binary file (UBF) and a known malicious source code file (KMSCF) to decompile the UBF into a text-based unknown source code (USC) and identify whether the KMSCF is contained within the USC.