Control Flow Graph Comparison for Hidden Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional static and dynamic analysis methods are ineffective in detecting new types of malicious code and take too long to respond to zero-day attacks, necessitating a more efficient method to identify hidden malicious behaviors.
Innovation Solution
A method involving generating a first control flow graph through dynamic analysis, extracting a second CFG by forced execution of conditional branch instructions, and comparing these graphs to detect hidden malicious code, using a pattern analysis and signature generation to confirm malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional static or dynamic analysis methods are used to detect malicious code, then well-known malicious code can be detected effectively, but new types of malicious code cannot be detected and response time is too long
Solution Approach 1:
The patent segments the program analysis into two distinct control flow graphs: the first CFG from normal dynamic analysis and the second CFG from forced execution of conditional branches. By dividing the analysis into separate executable and non-executable code paths, the system can identify hidden malicious code that would otherwise remain undetected by conventional methods
Solution Approach 2:
The patent performs preliminary action by generating the second CFG through forced execution of conditional branch instructions before final detection. This advance exploration of all possible execution paths including those normally not taken allows the system to prepare detection of hidden malicious code in advance, reducing response time for new threats
2Loss of information
If dynamic analysis is performed to execute the program and analyze execution results, then execution information can be obtained, but hidden code that is not executed cannot be detected
Solution Approach 1:
The patent applies inversion by forcing execution of conditional branch instructions that would normally not be executed during standard program runtime. By inverting the normal execution flow and forcing paths that are typically skipped, the system reveals hidden malicious code segments that remain invisible to conventional dynamic analysis
3Reliability
If the program is executed in a sandbox environment to analyze execution results, then the impact of malicious code can be evaluated, but the detection process takes a lot of time
Solution Approach 1:
The patent extracts only the essential execution paths by generating a second CFG that focuses specifically on conditional branch instructions and their target addresses. By extracting and analyzing only these critical paths rather than executing the entire program in a sandbox, the system reduces detection time while maintaining reliability in identifying hidden malicious code
Data Source
AI summary
A method of detecting malicious behavior in a malicious behavior detection apparatus that detects malicious behavior by analyzing the code of a program, comprises generating a first control flow graph (CFG) by performing dynamic analysis on the program, generating a second CFG by extracting a code block that is likely to be executed by a conditional branch instruction included in the program, and comparing the first CFG and the second CFG to detect hidden code included in the program, and detecting a malicious behavior of the program by determining whether the detected hidden code is a malicious code. According to the constitutions, the time it takes to discover and respond to new types of malicious code can be shorten by extracting hidden code related to the malicious behavior and detecting malicious behavior.