Binary Malware Detection Using Multi-Detector RTE Code Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods struggle to identify obfuscated or encrypted threats, particularly binary cyber weapons, which can remain undetected due to their low observability and complex nature, posing a risk of malicious execution paths.
Innovation Solution
A system employing multiple detectors to analyze run time environment (RTE) code and associated interpretive code, using techniques such as special cipher character detection, malware detection, and spectral analysis, with machine learning models to identify potential compromises and generate alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple detectors and analysis techniques are employed to detect obfuscated or encrypted malware, then detection capability is improved, but system complexity increases
Solution Approach 1:
The malware detection system is divided into multiple specialized detectors, each responsible for specific detection tasks such as cipher character detection, malware signature detection, and behavioral analysis. This segmentation allows each detector to focus on particular aspects of malware detection, improving overall detection precision while maintaining manageable complexity through modular architecture
Solution Approach 2:
The detection system employs multi-functional detectors that can perform multiple analysis techniques including spectral analysis, entropy analysis, and pattern recognition. These detectors are designed to handle various types of malware obfuscation methods universally, allowing the system to detect different malware variants using the same core detection mechanisms
2Measurement precision
If advanced detection techniques such as spectral analysis and cipher character detection are used, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary analysis by first detecting cipher characters and performing initial spectral analysis on code segments before full malware detection is executed. This preliminary action identifies suspicious patterns early, allowing the system to focus more intensive analysis only on potentially malicious segments, thereby improving detection accuracy while reducing overall processing time
Solution Approach 2:
The detection system applies partial analysis to code segments that appear benign based on initial scanning, and reserves full spectral analysis and cipher detection for segments that show suspicious characteristics. This selective application of intensive analysis techniques maintains high detection accuracy for malicious code while minimizing processing time for benign code
Data Source
AI summary
Binary malware attack detection according to an example includes processing, by a first set of one or more detectors, run time environment (RTE) code and associated interpretive code to detect special cipher characters and determine a first set of scores. A second set of one or more detectors processes the RTE code and the associated interpretive code to detect malware and determine a second set of scores. It is determined whether one or both of the RTE code and the associated interpretive code are compromised based on the first set of scores and the second set of scores.