.NET Runtime Method Hooking for Low-Level Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malware in the .NET platform are ineffective against malware that does not utilize system calls, as they operate at a low level, making it challenging to identify malicious activities due to truncated data and lack of meaningful markers.
Innovation Solution
The method intercepts .NET calls by inserting program patches in the intermediate language, modifying .NET methods and native image libraries to log and analyze current activities, allowing for malware detection by generating an activity log.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If conventional system calls interception methods are used, then malware detection is possible for high-level operations, but malware written in .NET platform that operates at low level without system calls cannot be detected
Solution Approach 1:
The patent introduces an intermediary layer - the Common Language Runtime (CLR) - between the .NET application code and the operating system. By inserting hooks into the CLR's intermediate language execution, the system can intercept and monitor .NET operations without requiring direct access to system calls, thus solving the detection problem for low-level malware operations.
Solution Approach 2:
The patent shifts the detection dimension from the operating system level (system calls) to the runtime environment level (CLR intermediate language). This dimensional change allows detection of .NET malware operations that occur at the language runtime level rather than at the system call interface, capturing malware behavior that would otherwise be invisible to conventional interception methods.
2Reliability
If malware operates at low level without system calls, then malware effectiveness is increased, but detection capability deteriorates due to truncated data and lack of meaningful markers
Solution Approach 1:
The patent implements a feedback mechanism where the CLR hooks capture execution information and return it to the detection system. This feedback loop ensures that even when malware operates at low levels without traditional system calls, the detection system receives comprehensive feedback about the malware's operations, including method calls, parameter values, and execution context, thereby preventing information loss.
Solution Approach 2:
The patent performs preliminary actions by pre-installing hooks into the CLR's intermediate language execution paths before malware operations occur. These hooks are prepared in advance to capture any .NET operations, ensuring that when malware executes, the detection infrastructure is already in place to capture complete activity data before any truncation or obfuscation can occur.
3Difficulty of detecting and measuring
If .NET methods are modified to add logging functionality, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent makes the CLR hooks universal by designing them to handle multiple detection scenarios simultaneously. The same hook infrastructure captures various types of .NET operations (method calls, property accesses, event subscriptions) across different assemblies and versions, providing multi-functional detection capability without requiring separate specialized systems for each detection need.
Solution Approach 2:
The patent uses copying by creating virtual copies of the .NET method execution paths through the CLR hooks. Instead of modifying the actual .NET methods or requiring deep integration with the .NET runtime, the system creates virtual copies that intercept and replicate the execution behavior, allowing detection without complex modifications to the original .NET framework or application code.
Data Source
AI summary
A method and a system for detecting malware activity in a .NET platform are provided. The method comprises: determining an architecture of the .NET platform; modifying contents of a given .NET method by adding thereto an executable payload, thereby generating a respective modified .NET method, the executable payload being configured for logging and storing data of current activities in the .NET platform; storing the respective modified .NET method in the .NET platform; in response to calling, by a .NET application, the respective modified .NET method: executing the executable payload to cause the logging the current activity in the .NET platform to generate an activity log; and transmitting the activity log for analysis to determine presence of the malware activity in the .NET platform.