Malware Analysis Using Canonical Executable Graphs and Genetic Algorithm Explainer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware analysis methods, including static and signature-based approaches, are inadequate in detecting evolving malware threats due to obfuscation techniques and the dynamic nature of these threats. Existing machine learning approaches also struggle to capture the semantic and structural aspects of malware effectively.
Innovation Solution
The proposed solution involves creating a Canonical Executable Graph (CEG) representation of Portable Executable (PE) files, which incorporates both syntactical and semantic information. This representation is then classified using a Graph Convolutional Neural Network (GCNN). Additionally, a Genetic Algorithm-based Graph Explainer (GAGE) is used to provide interpretable explanations for the classification results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static or signature-based analysis methods are used, then the analysis process is simple and fast, but the detection capability is insufficient against evolving malware threats
Solution Approach 1:
The patent transitions from static analysis to dynamic analysis by executing malware in a controlled environment and observing its behavior. The system captures runtime states, control flow graphs, and execution patterns that reveal the true nature of evolving malware threats, making the detection system adaptive to new threats rather than relying on pre-existing signatures.
Solution Approach 2:
The patent introduces a sandbox environment as an intermediary between the malware and the analysis system. This controlled execution environment allows safe observation of malware behavior without direct exposure to the host system, enabling detection of malicious activities while maintaining system security.
2Measurement precision
If deep learning models are used for malware analysis, then the detection accuracy is improved, but the interpretability of results deteriorates due to black-box nature
Solution Approach 1:
The patent segments the malware analysis into distinct components: control flow graph extraction, behavior pattern identification, and classification. By breaking down the complex deep learning process into interpretable stages, the system maintains high accuracy while allowing analysts to understand which behavioral patterns contributed to the classification decision.
Solution Approach 2:
The system provides feedback mechanisms that explain classification decisions by highlighting specific behavioral patterns and control flow characteristics that led to the malware identification. This feedback loop allows analysts to understand the reasoning behind predictions and verify their accuracy.
3Loss of information
If reverse engineering with Call Graphs and Control Flow Graphs is employed, then the semantic understanding is improved, but the analysis complexity and time consumption increase
Solution Approach 1:
The patent performs preliminary actions by automatically extracting control flow graphs and behavioral patterns during the execution phase in the sandbox. These preprocessing steps prepare the data in advance for classification, reducing the time required for detailed semantic analysis later while maintaining comprehensive understanding of malware behavior.
4Reliability
If obfuscation techniques are used by malware to evade detection, then the malware survival rate is improved, but the detection difficulty increases
Solution Approach 1:
The patent converts the harmful obfuscation techniques into beneficial detection signals by analyzing how malware attempts to hide its behavior. The system identifies patterns in obfuscation methods themselves as indicators of malicious intent, turning the malware's evasion strategies into detectable signatures that improve detection accuracy.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for malware analysis comprising: disassembling executable code to create disassembled instructions; extracting instruction blocks from the disassembled instructions; encoding the instruction blocks to create encoded instruction blocks and generating a first data graph, wherein the first data graph comprises nodes, each node from the first data graph being associated with an encoded instruction block; determining for each node an embedding of the encoded instruction block to create a canonical executable graph; classifying the canonical executable graph into either a benign family or a malicious family; and determining that the executable code is a malware when the canonical executable graph belongs to a malicious family.