Cloud Malware Detection via Dynamic Binary Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods struggle to identify repackaged malware, which evades detection by obfuscating its presence within other executable code or compressing it, making it difficult to detect using traditional pattern matching techniques like deep packet inspection, especially when the malware resides in memory and executes without generating observable system events.
Innovation Solution
The solution involves using a Dynamic Binary Instrumentation (DBI) framework to monitor and analyze the behavior of program code in real-time, performing deep packet inspection, and employing sandboxing techniques to execute suspicious code in a secure environment, while also generating signatures for future detection, thereby identifying and blocking malicious activities without relying on content-based detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional pattern matching methods like deep packet inspection are used to detect malware, then detection speed and resource efficiency are improved, but detection accuracy deteriorates because repackaged malware can evade detection by obfuscating its presence within other executable code or compressing it
Solution Approach 1:
The system performs preliminary actions by setting up a sandbox environment and instrumenting code before actual execution. Memory is allocated and instrumentation code is inserted in advance, allowing the system to capture unpacking operations and behavioral patterns as they occur during controlled execution, rather than relying on static pattern matching
Solution Approach 2:
The patent introduces an intermediary sandbox environment between the malware and the target system. This sandbox acts as a mediator that allows safe execution and observation of suspicious code, capturing memory operations and behavioral patterns without compromising the host system. The sandbox bridges the gap between static analysis and dynamic execution
2Measurement precision
If repackaged malware is allowed to execute in a normal environment for analysis, then behavioral detection accuracy is improved, but system security deteriorates due to the risk of malware execution
Solution Approach 1:
The patent creates an inert sandbox environment that isolates malware execution from the host system. This controlled environment allows suspicious code to execute and reveal its true behavior without posing a security risk to the main system. The sandbox acts as an inert atmosphere where harmful operations can be observed safely
Solution Approach 2:
The system segments the execution environment into isolated sandbox instances. Each suspicious file is executed in a separate, controlled memory space with allocated buffers and instrumentation. This segmentation allows behavioral analysis of multiple malware samples simultaneously without cross-contamination or host system compromise
3Measurement precision
If memory extraction of malware code is performed to analyze unpacked malicious code, then detection capability against repackaged malware is improved, but detection complexity increases because memory extraction does not generate observable operating system events
Solution Approach 1:
The system implements feedback mechanisms through instrumentation code that monitors memory operations. When malware unpacks code into memory, the instrumentation detects these operations and provides feedback about the unpacking process. This feedback loop allows the system to dynamically adjust analysis based on observed behavioral patterns without requiring complex external observation systems
Solution Approach 2:
The patent replaces traditional mechanical scanning methods with software-based instrumentation and memory monitoring. Instead of using external tools to observe memory operations, the system inserts instrumentation code directly into the execution flow, substituting physical observation mechanisms with software-based tracking that operates transparently during code execution
Data Source
AI summary
Methods and apparatus consistent with the present disclosure may be performed by a Cloud computing device may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into, may perform deep packet inspection (DPI) on computer data, or identify a content rating associated with computer data. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set. Furthermore, access to content associated with malware, potential malware, or with inappropriate content ratings may be blocked.