Detecting Executable Instructions in Data Streams via Entropy and String Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques face challenges in identifying executable machine instructions hidden within non-executable data streams, as attackers use obfuscation and embedding methods, making it difficult to distinguish between human-readable and machine-readable data, and existing entropy measurements are not robust enough to guarantee detection.
Innovation Solution
A combination of entropy measurement and string analysis, including brute force disassembly, is used to identify executable machine instructions by analyzing the ratio of string to non-string data and validating disassembly results, ensuring a robust detection method.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If entropy measurement is used to identify executable machine instructions, then detection capability is improved, but reliability is insufficient because entropy measurements are not robust enough to guarantee detection
Solution Approach 1:
The patent combines multiple detection techniques including entropy measurement, string ratio analysis, and brute force disassembly into a unified detection system. This merging of methods allows the system to leverage the strengths of each individual technique while compensating for their weaknesses, thereby improving both detection capability and reliability simultaneously
Solution Approach 2:
The system implements feedback mechanisms where disassembly results are validated against expected characteristics, and detection outcomes inform subsequent analysis steps. This feedback loop enables the system to refine its detections and improve reliability by learning from its own results and adjusting its detection parameters accordingly
2Object-affected harmful factors
If attackers use obfuscation and embedding methods to hide malware, then malware detection difficulty increases, but this creates a technical contradiction where detection precision deteriorates while the need for detection remains
Solution Approach 1:
The patent changes multiple parameters including entropy thresholds, string ratio cutoffs, and disassembly validation criteria to adapt to different obfuscation techniques. By dynamically adjusting these parameters based on the detected characteristics of the data stream, the system maintains high precision in identifying machine instructions even when they are obfuscated or embedded
Solution Approach 2:
The detection system uses a composite approach combining multiple analysis methods (entropy analysis, string analysis, disassembly) similar to how composite materials combine different properties. This composite detection strategy enables the system to identify malware regardless of the specific obfuscation method used, as each component of the composite approach detects different aspects of the hidden instructions
3Measurement precision
If brute force disassembly is performed to validate machine instructions, then detection accuracy is improved, but device complexity and processing time increase
Solution Approach 1:
The patent segments the data stream into smaller blocks for individual disassembly and analysis. By processing data in segments rather than as a whole, the system reduces the computational complexity of each disassembly operation while maintaining overall detection accuracy. The segmentation allows parallel processing and enables the system to manage complex analysis tasks more efficiently
Solution Approach 2:
The system performs partial disassembly by focusing only on segments that meet preliminary entropy and string ratio criteria. Rather than disassembling the entire data stream, the system applies brute force disassembly only to candidate regions, thereby reducing overall processing complexity while maintaining high validation accuracy for the most suspicious segments
Data Source
AI summary
Detecting executable machine instructions in a data stream is accomplished by accessing a plurality of values representing data contained within a memory of a computer system and performing pre-processing on the plurality of values to produce a candidate data subset. The pre-processing may include determining whether the plurality of values meets (a) a randomness condition, (b) a length condition, and/or (c) a string ratio condition. The candidate data subset is inspected for computer instructions, characteristics of the computer instructions are determined, and a predetermined action is taken based on the characteristics of the computer instructions.