Malware Detection via CPU Cache Miss Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based malware detection methods fail to effectively identify packed executables containing junk instructions, as these packers alter byte-level representations and insert junk instructions to evade detection, making it difficult to discriminate between junk and actual code.
Innovation Solution
The method involves emulating the execution of an executable up to a first count of instructions, counting cache misses, and comparing them to a threshold to identify potentially malicious files, thereby distinguishing between packed executables with junk instructions and those without.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If packers insert junk instructions in code stream, then malware detection difficulty increases, but executable functionality is preserved
Solution Approach 1:
The patent extracts and removes junk instructions from the code stream through emulation-based analysis. The system identifies instructions that do not contribute to actual program functionality by analyzing execution patterns and data flow, then filters them out to reveal the underlying malware payload for detection.
Solution Approach 2:
The patent introduces an emulation environment as an intermediary between the packed executable and the detection system. This virtual execution environment allows the system to observe actual instruction behavior and effects without directly executing the malicious code, enabling safe analysis of junk instruction patterns.
2Measurement precision
If traditional entropy-based detection is used, then detection speed is fast, but detection accuracy decreases due to junk instructions
Solution Approach 1:
The patent applies partial emulation by executing only a limited number of instructions or analyzing specific code sections rather than fully emulating the entire executable. This approach provides sufficient information to detect malware presence while avoiding the time cost of complete execution analysis.
Solution Approach 2:
The patent performs preliminary analysis of the code stream to identify and remove junk instructions before conducting main detection operations. This preprocessing step simplifies subsequent analysis and improves overall detection efficiency by eliminating distracting non-functional instructions early in the process.
3Adaptability or versatility
If packers change byte-level representations, then signature-based detection fails, but program execution semantics are maintained
Solution Approach 1:
The patent replaces static signature-based detection with dynamic behavior-based analysis through emulation. Instead of relying on fixed byte-pattern matching that packers can easily evade, the system observes actual execution behavior, instruction effects, and control flow patterns that remain consistent regardless of code obfuscation.
Solution Approach 2:
The patent changes the detection parameter from static byte-level patterns to dynamic execution characteristics such as instruction frequency, data access patterns, and control flow behavior. These parameters remain relatively stable across different packing schemes while maintaining the underlying program semantics, enabling reliable detection despite code transformation.
Data Source
AI summary
Techniques are presented for detecting malware in an executable. The method includes receiving an executable to evaluate for malware, emulating an execution of the executable up to a first count of instructions, determining a number of cache misses that occur while emulating the executable up to the first count of instructions, comparing the number of cache misses to a threshold, and upon determining the number of cache misses exceeds the threshold, identifying the executable as potentially containing malware.