Dynamic Malware Detection via Virtual Execution Behavior Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus software is ineffective in detecting and preventing modified malware, as it relies on static signature matching and cannot identify malware based on dynamic behavior, leading to costly and inefficient updates for novel or reorganized malware variants.
Innovation Solution
A malware detection system that evaluates executable code modules by executing them in a virtual environment to record and compare their dynamic behaviors against known malware signatures, allowing for detection based on exhibited behaviors rather than static signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-virus software uses static signature matching to detect known malware, then detection speed and accuracy for known malware are improved, but the ability to detect modified or rewritten malware deteriorates
Solution Approach 1:
The patent transitions from static signature matching to dynamic behavior monitoring. The system executes code modules in a virtual environment and observes their runtime behavior (file creation, registry modifications, network connections) to detect malware. This dynamic approach allows detection of rewritten malware that maintains functional behavior despite code modifications, resolving the contradiction between static detection accuracy and adaptability to modified malware.
Solution Approach 2:
The system changes the detection parameter from static code signatures to dynamic behavior parameters. Instead of analyzing fixed code patterns, the system monitors behavioral parameters such as file access patterns, process creation sequences, and network communication characteristics. This parameter transformation enables detection of malware variants that alter their code appearance while maintaining characteristic malicious behaviors.
2Adaptability or versatility
If anti-virus software updates signatures to detect new malware variants, then detection coverage is improved, but update frequency and system complexity increase
Solution Approach 1:
The system performs self-learning by automatically analyzing the behavior of executed code modules and building a profile of legitimate versus malicious behavior patterns. Instead of relying on manual signature updates, the system self-adjusts its detection criteria based on observed behavior, reducing the need for frequent manual updates while maintaining high detection coverage.
Solution Approach 2:
The system implements feedback mechanisms where observed malware behaviors are fed back into the detection system to refine future detection criteria. This continuous feedback loop allows the system to adapt to new malware variants without requiring manual signature updates, reducing operational complexity while improving detection coverage.
3Measurement precision
If the system executes code modules in a virtual environment to analyze behavior, then detection accuracy for rewritten malware is improved, but system resources and execution time increase
Solution Approach 1:
The system performs partial execution analysis by monitoring only specific critical behaviors and system calls rather than fully executing and analyzing every operation. This selective monitoring approach provides sufficient detection accuracy for malware identification while significantly reducing computational resource consumption compared to complete execution analysis.
Solution Approach 2:
The virtual environment is segmented into isolated execution contexts, allowing parallel analysis of multiple code modules simultaneously. This segmentation enables resource-efficient behavior analysis by distributing computational load across multiple isolated environments, reducing the resource consumption impact of comprehensive behavioral monitoring.
Data Source
AI summary
A malware detection system that determines whether an executable code module is malware according to behaviors exhibited while executing is presented. The malware detection system determines the type of code module and executes the code module in a behavior evaluation module for evaluating code corresponding to the code module's type. Some behaviors exhibited by the code module, while executing in the behavior evaluation module, are recorded as the code module's behavior signature. After the code module has completed its execution, the code module's behavior signature is compared against known malware behavior signatures stored in a malware behavior signature store. A determination as to whether the code module is malware is based on the results of the comparison.