.NET Binary Code Signatures for Obfuscation-Resistant Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques struggle to accurately identify and prevent malicious software due to increasingly sophisticated obfuscation methods employed by malware authors, leading to high false positives and negatives.
Innovation Solution
Transforming the Microsoft Intermediate Language (MSIL) code of .NET binaries into a uniform format, generating a file signature (DNCodeHash) by hashing wildcarded method representations, which is used for malware detection and clustering, reducing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware authors use sophisticated obfuscation techniques, then malware can evade detection more easily, but detection accuracy decreases leading to high false positives and negatives
Solution Approach 1:
The patent introduces an intermediary representation layer (wildcarded MSIL code) between the original malware binary and the detection signature. This intermediary form preserves the structural characteristics of malware while being invariant to common obfuscation techniques like renaming, reordering, and minor code modifications. The wildcarding process converts specific code patterns into generalized templates that match across obfuscated variants, thereby maintaining high detection accuracy despite increasing obfuscation complexity.
Solution Approach 2:
The patent transforms the detection approach by changing parameters from comparing raw binary code or traditional signatures to comparing wildcarded MSIL code structures. This parameter change involves converting code into a normalized intermediate representation where obfuscation-relevant variables (names, addresses, minor syntactic variations) are replaced with wildcards, while structural and behavioral patterns are preserved. This allows the detection system to remain reliable even as obfuscation techniques become more sophisticated.
2Measurement precision
If traditional signature-based detection is used, then detection speed is fast, but accuracy is low due to obfuscation leading to high false positives and negatives
Solution Approach 1:
The patent performs preliminary transformation of malware code into wildcarded MSIL representation during the signature generation phase. This preliminary action creates a standardized, obfuscation-resistant form that can be quickly compared against known malware patterns. By pre-processing the code into this intermediate representation, the system avoids time-consuming analysis during actual detection, achieving both high precision and fast detection speed.
Solution Approach 2:
The patent creates a copied and transformed version of the original code (wildcarded MSIL) that serves as the basis for detection signatures. This copy preserves the essential structural characteristics while being invariant to obfuscation. The copying process involves converting the original binary into MSIL, applying wildcarding rules, and generating signatures from this transformed copy, which can then be efficiently matched against suspicious files without requiring complex analysis of the original obfuscated code.
3Reliability
If code transformation and hashing is performed for signature generation, then detection accuracy improves, but processing complexity increases
Solution Approach 1:
The patent segments the code transformation process into distinct, manageable stages: (1) disassembly of binary to MSIL, (2) wildcarding of specific code elements, (3) normalization of the wildcarded code, and (4) hashing to generate signatures. Each segment handles a specific aspect of the transformation, making the overall complex process more manageable and maintainable. This segmentation allows the system to achieve high detection reliability through systematic processing while keeping the complexity organized and controllable.
Data Source
AI summary
Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.