ELF Malware Detection via Corruption and OS Runnability Checks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security tools are unable to effectively detect malicious ELF files that are intentionally corrupted to evade parsing and remain runnable by the Linux OS, posing a security risk.

Innovation Solution

A security agent checks ELF files for corruption and runnability using Linux kernel checks, deciding on potential maliciousness and initiating responsive actions for further analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If security tools use traditional parsing methods to analyze ELF files, then they can identify valid files, but they fail to detect malicious files that are intentionally corrupted to evade parsing

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect corrupted files

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

Instead of checking whether corrupted files can be parsed (traditional approach), the invention inverts the logic by checking whether the Operating System can execute the file despite parsing failures. This inversion allows detection of malicious ELF files that are corrupted but still runnable by the OS, thereby resolving the contradiction between maintaining detection accuracy for valid files and adapting to detect corrupted malicious files.

Inventive Principle:

Principle #13The other way round (Inversion)

2Manufacturing precision

If the system performs comprehensive parsing validation on ELF files, then it ensures format correctness, but it misses malicious files that exploit OS tolerance for format deviations

Engineering Contradiction:

Improveformat complianceVSAvoidsecurity detection reliability

Core Design Contradiction:

Manufacturing precisionVSReliability

Solution Approach 1:

The invention introduces the Operating System as an intermediary validator between the security tool and the ELF file. While the security tool performs parsing validation, the OS serves as a mediator that actually attempts to execute the file. This intermediary approach allows the system to maintain format compliance checks while simultaneously ensuring security detection reliability by leveraging the OS's actual execution capability to identify runnable corrupted files.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If security tools strictly enforce ELF format specifications, then they maintain parsing accuracy, but they cannot identify files that are corrupted yet still executable by the OS

Engineering Contradiction:

Improveparsing accuracyVSAvoidundetected malicious files

Core Design Contradiction:

Measurement precisionVSObject-generated harmful factors

Solution Approach 1:

The invention performs a preliminary execution attempt by the Operating System before finalizing the security assessment of an ELF file. This preliminary action allows the system to maintain parsing accuracy for format validation while simultaneously identifying corrupted but executable files that would otherwise remain undetected. The OS's preliminary execution check reveals malicious files that exploit format specification deviations.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20260064842A1Detection of Malicious Executable and Linkable Format (ELF) Files

Publication Date: 2026.03.05 PALO ALTO NETWORKS INC

AI summary

A method for cyber-security includes receiving an Executable and Linkable Format (ELF) file for analysis, and checking (i) whether the ELF file is corrupted and (ii) whether the ELF file is runnable by an Operating System (OS). Upon finding that the ELF file is corrupted but runnable by the OS, a decision is made that the ELF file is potentially malicious, and a responsive action is initiated.