Detecting Malicious Shell Codes via Debugging Events
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems are ineffective in identifying malicious non-executable files, particularly those used in Advanced Persistent Threats (APT) attacks, as they rely on signature-based inspection methods that struggle with modifications and unknown types of malicious codes, leading to false negatives and require extensive signature databases, making it difficult to protect against Zero-day exploits.
Innovation Solution
An apparatus and method that utilize debugging events to determine the maliciousness of non-executable files by acquiring address range information of loaded modules in memory and analyzing Structured Exception Handling (SEH) for vulnerabilities, allowing for the detection of malicious codes even if they are not in a blacklisted candidate address.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If signature-based inspection methods are used to detect malicious codes, then detection speed is improved, but detection accuracy deteriorates due to false negatives and inability to detect unknown threats
Solution Approach 1:
The patent divides the detection process into multiple independent analysis dimensions: header information analysis, body information analysis, and debugging event monitoring. Each dimension operates independently to detect different aspects of malicious code, allowing the system to maintain high detection speed while improving accuracy through multi-faceted verification rather than relying on a single signature database lookup
Solution Approach 2:
The patent introduces debugging events as an intermediary mechanism between the executable file and the detection system. By monitoring debugging events generated during file execution, the system can detect malicious behavior patterns without relying solely on pre-defined signatures, thus improving detection accuracy for unknown threats while maintaining operational speed
2Adaptability or versatility
If signature databases are expanded to cover more malicious code variants, then detection coverage is improved, but system complexity increases
Solution Approach 1:
The patent enables the detection system to automatically analyze and extract characteristics from executable files during debugging events, rather than relying on manually maintained signature databases. The system self-generates detection rules by analyzing header information, body information, and runtime behavior, significantly reducing system complexity while expanding detection coverage to include unknown and variant malicious codes
Solution Approach 2:
The patent changes the detection parameters from static signature matching to dynamic analysis of header information, body information, and debugging event characteristics. This parameter transformation allows the system to detect a broader range of malicious codes without requiring expansion of signature databases, thereby improving coverage while maintaining manageable system complexity
3Reliability
If conventional detection methods are used on non-executable files, then false positive rate is reduced, but detection capability against APT threats deteriorates
Solution Approach 1:
The patent performs preliminary analysis of header information and body information before executing the file, and continues monitoring during debugging events. This multi-stage preliminary and ongoing analysis allows the system to identify APT threats in non-executable files while maintaining low false positive rates through progressive verification at each stage
Data Source
AI summary
An apparatus for detecting malicious shell codes using a debugging event includes an alert setting unit configured to set a mother program to run a non-executable file to trigger the debugging event when a mother process created by the mother program tries to execute a code with no execution attribute; and an information storage unit configured to store information on an address range in which modules to be used by the mother process are loaded in a memory. Further, the apparatus includes a malicious code determination unit configured to determine whether the non-executable file is malicious using the information on the address range when there occurs the debugging event.