Binary File Analysis via Suspiciousness Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for analyzing binary code, such as the sandbox approach, are limited in identifying potentially malicious software, as they may not detect code that does not immediately perform malicious actions and are impractical for widespread application.
Innovation Solution
A technique involving a set of rules for binary file analysis, where each rule has a suspiciousness score, allowing for the evaluation of field contents to determine if a binary file is suspicious, without transferring control of the computer, and reporting it as such if the score meets a criterion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandbox approach is used to analyze binary code, then safety is improved by isolating malicious code, but productivity deteriorates due to difficulty in subjecting every binary code to testing
Solution Approach 1:
The patent segments the binary code into individual fields and analyzes each field separately using a parser. This allows the system to evaluate multiple fields concurrently without requiring full sandbox execution for each field, thereby improving analysis throughput while maintaining safety through controlled interpretation.
Solution Approach 2:
The patent performs preliminary analysis of binary code fields by retrieving and evaluating their contents against established rules before actual execution. This preliminary evaluation identifies suspicious fields and assigns suspiciousness scores, allowing the system to prioritize or skip full sandbox testing based on pre-analysis results.
2Reliability
If sandbox approach is used to analyze binary code, then reliability is improved by preventing data impact, but time consumption increases due to extended analysis duration
Solution Approach 1:
The patent applies partial action by analyzing only specific fields within the binary code rather than executing the entire code in a sandbox. The parser selectively retrieves and evaluates field contents against rules, assigning suspiciousness scores to individual fields. This partial analysis approach reduces time consumption while maintaining data protection through controlled interpretation.
3Productivity
If rule-based evaluation is applied to binary fields, then productivity is improved by enabling rapid analysis, but measurement precision may deteriorate compared to full sandbox testing
Solution Approach 1:
The patent implements feedback mechanisms by establishing multiple rules for different binary fields, each with associated suspiciousness scores. The system evaluates field contents against these rules and accumulates scores to determine overall suspiciousness. This feedback loop allows the system to refine its detection accuracy by comparing rule-based evaluations with established criteria, improving measurement precision while maintaining high productivity.
Data Source
AI summary
Binary file analysis is based on a measure of suspiciousness indicating level of doubt as to whether a process executing under control of an operating system machine can access and interpret contents of a binary file safely. Various parameters of a binary file may be classified and identified to construct a set of rules for components therein. Each rule in the set may be assigned a suspiciousness score that indicates a degree of confidence as to whether safe execution of the process on the binary file can be achieved. Analysis is performed while access to the binary file excludes interpreting the contents thereof and indicates a suspicious file when the suspiciousness score meets an established criterion.