.NET Malware Detection Using Unmanaged Imphash Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malware in .NET files are inadequate due to the similarity of import tables in .NET assemblies, leading to high false positives and poor detection rates, especially since .NET files are compiled into intermediate language and do not reflect win32 API functions in the import table of the PE header.
Innovation Solution
The system parses the .NET header of a file to extract unmanaged imports, determines a hash of these imports (Unmanaged Imphash), and compares it to a blacklist to identify malicious files, utilizing a sandbox environment and historical data from services like VirusTotal for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PE file structure analysis is used for malware detection, then detection coverage is achieved, but false positives increase and detection accuracy decreases
Solution Approach 1:
The patent extracts the .NET header section from the PE file structure to perform specialized analysis. By isolating and analyzing only the .NET header portion rather than the entire PE file, the system achieves more accurate malware detection specific to .NET applications while avoiding false positives from other PE file types. This extraction principle allows focused detection on the relevant structural elements that differentiate .NET malware.
2Reliability
If traditional PE header analysis is used, then general malware detection is possible, but detection of .NET-specific malware is poor
Solution Approach 1:
The patent segments the malware detection process into two distinct parts: general PE file analysis and specialized .NET header analysis. By dividing the detection methodology and applying different analysis techniques to different file sections, the system achieves high detection rates for both general and .NET-specific malware without requiring a completely complex unified approach.
3Measurement precision
If unmanaged imphash from .NET header is used, then false positives are reduced, but computational requirements increase
Solution Approach 1:
The patent uses hash values (imphash) as simplified copies or representations of the actual unmanaged API imports in the .NET header. Instead of analyzing the complete import tables during runtime detection, the system computes hash values that serve as compact fingerprints. This copying approach dramatically reduces computational resources and energy requirements while maintaining high precision in malware identification.
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting malicious files. The method includes receiving a sample that comprises a .NET file, obtaining imported API function names based at least in part on a .NET header of the .NET file, determining a hash of a list of unmanaged imported API function names, and determining whether the sample is malware based at least in part on the hash of the list of unmanaged imported API function names.