Dynamic Analysis Component Injection for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep dynamic analysis techniques for malware detection on endpoint devices face challenges in efficiently identifying malware without interfering with other software, causing performance degradation and being discovered by malware, which necessitates improved methods for deep analysis in a safe isolated environment.
Innovation Solution
A method involving a deep dynamic analysis process that injects a dynamically loaded component into an application's address space, parses dependencies, hooks system functions, creates separate memory maps, and monitors exception handlers to determine if an application is malware, while disguising the analysis tool's presence and maintaining control to prevent malware from copying system library code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep dynamic analysis is performed on endpoint devices to detect malware, then malware detection capability is improved, but system performance degrades and resource consumption increases
Solution Approach 1:
The system segments analysis functions by deploying a sandbox environment that isolates malware analysis from the host system. The sandbox creates separate virtual execution contexts where malware can be analyzed without affecting the performance of the endpoint device's normal operations.
Solution Approach 2:
The patent introduces an intermediary layer (sandbox environment) between the malware analysis process and the endpoint device. This intermediary handles all resource-intensive analysis operations, preventing direct performance degradation of the host system while maintaining comprehensive malware detection capabilities.
2Measurement precision
If comprehensive monitoring and analysis activities are implemented on user devices, then malware detection accuracy is improved, but interference with other software increases
Solution Approach 1:
The system extracts monitoring and analysis activities from the host operating system into a separate sandbox environment. This extraction allows comprehensive malware analysis to be performed without the monitoring activities interfering with other software running on the endpoint device, as all analysis occurs in the isolated sandbox context.
3Manufacturing precision
If analysis tools modify processes under analysis to perform deep inspection, then analysis depth is improved, but malware may discover and evade the analysis tool
Solution Approach 1:
The sandbox environment implements local quality control by creating distinct execution contexts with different visibility properties. Within the sandbox, the analysis tool can perform deep modifications and inspections, while the endpoint device outside the sandbox perceives only normal, unmodified process behavior. This local differentiation allows deep analysis without revealing the tool's presence to malware.
4Reliability
If thorough malware analysis is performed, then detection completeness is improved, but false positives increase and user experience is disrupted
Solution Approach 1:
The system creates a copy of the suspicious process within the sandbox environment for thorough analysis, while the original process continues to run normally on the endpoint device. This copying approach allows complete malware detection analysis to be performed on the duplicate, generating accurate detection results without disrupting the user's normal interaction with the original application.
Data Source
AI summary
Disclosed herein are systems and method for deep dynamic analysis for protecting endpoint devices from malware. In one aspect, an exemplary method comprises launching a deep analysis process, by a deep analysis tool, the launching including: injecting a dynamically loaded component into an address space of an application code and initializing, by the dynamically loaded component, to allow an execution activity, by the injected dynamically loaded component, parsing dependencies of run-time linkages, hooking system functions, creating an application memory map with separate application and system code areas, transferring control back to the application code, and performing on-sample-execution activity, obtaining control of exception handler and monitoring attempts to use the exception handler, changing an available area, logging accesses, inspecting exception reasons and applying policies, determining whether or not the application of the sample is a malware, and sending a final verdict.