Dynamic Malware Analysis Time Limiting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, particularly static analysis and dynamic analysis, face challenges in efficiently identifying malware in large volumes of computer data. Static analysis is limited to detecting previously characterized malware, while dynamic analysis consumes significant time and resources, making it impractical for widespread application.
Innovation Solution
A method that involves executing instructions from received computer data within an allocated time frame, collecting data on actions performed, and comparing this data to known good behavioral and system state information. This allows for the identification of actions consistent with known good program code, enabling the rapid classification of data as malware-free or suspicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is performed on all received computer data, then malware detection accuracy is improved, but system resources are saturated and processing time increases
Solution Approach 1:
The analysis system is divided into two distinct segments: a fast static analysis component that handles the majority of traffic, and a selective dynamic analysis component that processes only suspicious files. This segmentation allows the system to maintain high throughput while preserving detection accuracy for potentially malicious files.
Solution Approach 2:
Instead of performing complete dynamic analysis on all files, the system applies partial analysis only to files that exhibit suspicious characteristics identified by static analysis. This partial action approach reduces resource consumption while maintaining effective malware detection for the files that need it most.
2Adaptability or versatility
If dynamic analysis is performed on all received computer data, then new malware can be detected, but processing time and resource consumption increase significantly
Solution Approach 1:
Static analysis is performed as a preliminary action before dynamic analysis. This preliminary screening identifies suspicious files that warrant deeper investigation, allowing the system to detect new malware patterns while avoiding the time cost of dynamic analysis on every file.
Solution Approach 2:
The system applies different analysis qualities to different files based on their risk profile. High-quality dynamic analysis is applied locally only to suspicious files, while the majority of files receive faster static analysis. This local quality approach enables new malware detection where needed without universal time penalties.
3Reliability
If infrastructure is scaled to perform dynamic analysis on all distributed computer data, then detection capability is improved, but infrastructure costs increase significantly
Solution Approach 1:
The infrastructure is segmented into two tiers: a distributed static analysis layer that handles the bulk of traffic across multiple nodes, and a centralized or selective dynamic analysis layer that processes only suspicious files. This segmentation reduces the scaling requirements for expensive dynamic analysis infrastructure while maintaining detection capability.
Solution Approach 2:
The system uses static analysis signatures and behavioral patterns as copies or proxies for full dynamic analysis. Instead of replicating expensive dynamic analysis infrastructure across all nodes, the system distributes lightweight static analysis capabilities that can identify files requiring more intensive examination.
Data Source
AI summary
The present disclosure is directed to analyzing received sets of computer data. Methods and apparatus consistent with the present disclosure may forecast that a received set of computer data does not include malware after allowing instructions included in that set of computer data to execute for an amount of time that does not exceed an allocated amount of time. Methods consistent with the present disclosure may instrument a set of received program code and allow instructions in that received set of program code to execute as instrumentation code collects information about the set of program code. This collected information may be compared with sets of known good data when determining whether a received set of program code is likely not to include malware. This collected information may be associated with “behaviors” performed by the received set of program code that may be identified using sets of contextual data.