Dynamic Binary Instrumentation for Repackaged Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods struggle to identify repackaged malware, which evades detection by obfuscating its code within other executable files or compressing it, making it difficult to detect using traditional pattern matching techniques like deep packet inspection, and require memory dumps that are challenging to analyze for malicious activity.
Innovation Solution
A method that uses dynamic binary instrumentation to monitor and analyze the behavior of program code in real-time, preventing execution of suspected malware using exception handling and scanning for malicious patterns, allowing for detection of malicious code without relying on content-based detection methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional pattern matching methods like deep packet inspection are used to detect malware, then detection of known malware signatures is effective, but detection of repackaged or obfuscated malware fails
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavior-based detection. By monitoring runtime behavior of code in memory, the system adapts to detect repackaged malware that exhibits characteristic malicious behaviors even when its signature is obscured or modified.
Solution Approach 2:
The detection approach changes from analyzing fixed parameters (signatures, hashes) to monitoring dynamic parameters (behavior patterns, execution sequences). This parameter transformation enables detection of repackaged malware by observing what the code actually does rather than what it claims to be.
2Loss of information
If memory dumps are taken for malware analysis, then malware code can be extracted, but analysis becomes challenging due to mixture of normal and malicious data
Solution Approach 1:
The system extracts only the relevant malicious components from memory by monitoring and tracking code execution behavior. Instead of analyzing entire memory dumps, it isolates and analyzes specific code segments that exhibit suspicious behavior patterns, significantly reducing analysis complexity.
Solution Approach 2:
The system introduces an intermediary monitoring layer that observes code execution and identifies malicious behavior patterns. This intermediary acts as a filter between the complex memory contents and the analysis process, presenting only the relevant malicious elements for analysis.
3Measurement precision
If repackaged malware is executed to analyze its behavior, then detection of obfuscated malware is possible, but the malware can cause damage before detection
Solution Approach 1:
The system performs preliminary detection by monitoring code behavior as it is being executed in memory, before the malware can complete its malicious payload. By detecting suspicious behavior patterns early in the execution sequence, the system can intervene and prevent damage while still maintaining detection accuracy.
Solution Approach 2:
The system rapidly analyzes code execution behavior and makes quick determination about maliciousness, rushing through the detection process before the malware can cause significant harm. This time-compressed detection approach maintains accuracy while minimizing damage potential.
Data Source
AI summary
Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows one or more processors executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware can be detected using exception handling to track memory allocations of the program code included in the received data set.