Dynamic Binary Instrumentation for Just-in-Time Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods struggle to identify repackaged malware, which evades detection by obfuscating malicious code within other executable code or compressing it, making it difficult to detect using pattern matching techniques, and existing memory analysis is cumbersome due to the need to differentiate between normal and malicious data.
Innovation Solution
The use of a Dynamic Binary Instrumentation (DBI) framework to monitor and analyze program code in real-time, preventing execution of suspicious code until scanned for malware, and employing techniques like deep packet inspection and sandboxing to identify and classify malicious activities without relying on content-based detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional pattern matching methods are used for malware detection, then known malware can be identified, but repackaged and obfuscated malware evades detection
Solution Approach 1:
The system performs preliminary actions by analyzing memory regions before malware execution occurs. It identifies and marks suspicious memory regions as executable prior to actual code execution, enabling detection of repackaged malware in its compressed or obfuscated state before it can run and evade detection.
Solution Approach 2:
The patent introduces an intermediary mechanism using memory region marking and instrumentation frameworks. Instead of directly analyzing malware code patterns, the system uses marked memory regions as intermediaries to track and identify malicious behavior, bypassing the need for direct pattern matching of obfuscated code.
2Measurement precision
If memory extraction of code is performed to detect malware, then malicious code can be identified, but memory analysis is cumbersome and lacks context
Solution Approach 1:
The system applies local quality by focusing analysis on specific marked memory regions rather than performing comprehensive memory extraction. It identifies and isolates suspicious regions based on their characteristics (such as being marked as executable), providing targeted analysis that reduces complexity while maintaining precision.
Solution Approach 2:
The patent segments memory analysis by dividing the memory space into marked and unmarked regions. It processes only the marked regions that indicate potential malware presence, rather than analyzing entire memory dumps, thereby reducing computational complexity while maintaining detection accuracy.
3Productivity
If deep packet inspection is used to scan data packets, then known malware signatures can be detected, but repackaged malware with hidden code evades detection
Solution Approach 1:
The system replaces the mechanical approach of scanning packet contents with a different mechanism: marking memory regions as executable before malware execution. This substitution allows detection without direct packet inspection, enabling identification of repackaged malware that evades traditional scanning.
4Loss of time
If memory dumps are performed after malware execution to analyze actions, then post-execution analysis is possible, but normal and malicious data cannot be differentiated
Solution Approach 1:
The system performs preliminary marking of memory regions as executable before malware execution occurs. This timing allows differentiation between normal and malicious data based on the marking status, enabling precise identification of malicious acts at the moment they occur rather than after execution when context is lost.
Data Source
AI summary
Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows a processor executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware may be detected by scanning suspect program code with a malware scanner, malware may be detected by identifying suspicious actions performed by a set of program code, or malware may be detected by a combination of such techniques.