Executable Branch Modification for Evasive Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods fail to identify malicious software that masks its malicious behavior during observation in controlled environments, allowing it to evade detection.
Innovation Solution
Modify branch instructions in executable code to force execution of different paths and reveal masked malicious operations, using testing environments to evaluate the modified code for malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware detection methods observe executable code in controlled environments, then detection simplicity is maintained, but malware that masks its malicious behavior evades detection
Solution Approach 1:
The system performs preliminary modification of branch instructions in the executable code before execution in the controlled environment. By altering branch instructions in advance, the system forces the malware to reveal its malicious behavior during observation, rather than waiting for complex analysis techniques. This preliminary action transforms the detection approach from passive observation to active provocation of malicious behavior.
Solution Approach 2:
The system changes the parameters of the executable code by modifying branch instructions (e.g., changing jump conditions, altering execution flow). These parameter changes force the malware to take different execution paths than it would in a normal environment, thereby exposing hidden malicious operations. The modification of code parameters enables detection of malware that would otherwise mask its behavior through conditional logic.
2Measurement precision
If branch instructions are modified to reveal masked malicious operations, then malware detection accuracy improves, but the complexity of the detection system increases
Solution Approach 1:
The system creates copies of the original executable code and modifies branch instructions in these copies rather than the original. Multiple modified versions are generated, each with different branch instruction alterations, and executed in isolated testing environments. This copying approach allows comprehensive testing without risking the original code and enables systematic analysis of different execution paths.
Solution Approach 2:
The system introduces an intermediary layer between the original code and the testing environment. This intermediary modifies branch instructions and manages the creation of modified code copies, acting as a mediator that handles the complexity of code transformation while presenting simplified interfaces for detection operations. The intermediary isolates the complexity of modification operations from the core detection logic.
3Reliability
If multiple modified copies of executable code are tested in multiple environments, then false negatives are reduced, but testing time and resources increase
Solution Approach 1:
The system segments the testing process by dividing it into multiple independent testing environments, each executing specific modified copies of the code with particular branch instruction alterations. This segmentation allows parallel execution of multiple test cases, reducing overall testing time compared to sequential testing. Each segment focuses on detecting specific types of masked malicious behavior through targeted modifications.
Solution Approach 2:
The system applies partial modification to branch instructions rather than comprehensively altering all possible branches. By selectively modifying only the critical branch instructions that are most likely to mask malicious behavior, the system achieves effective detection with reduced testing overhead. This partial action approach balances thoroughness with efficiency, avoiding the time cost of exhaustive testing of all possible code variations.
Data Source
AI summary
A method for detecting malware by modifying executable code includes identifying executable code that includes branch instructions. The method includes determining whether any of the branch instructions of the executable code mask maliciousness of the executable code. The determining includes modifying first one or more of the branch instructions of the executable code, causing execution of the executable code with the modified first one or more branch instructions in a first testing environment, and evaluating a result of the execution of the executable code with the modified first one or more branch instructions. The result can indicate whether the executable code is malicious. The method includes, responsive to determining that the branch instructions of the executable code mask the maliciousness of the executable code, performing one or more preventative actions with respect to the executable code.