Emulation Data Assessor for Automated Application Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods rely heavily on manual simulation of system functions, which is reactive, error-prone, and expensive, and the only known alternative is licensing the original OS image for emulation, incurring high performance costs.
Innovation Solution
A communication system that uses data-mining and machine-learning strategies to automatically model and simulate the relevant logic for a profiled operating environment, allowing for the identification and simulation of system function calls and their parameters, enabling the emulation of software applications without manual intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual simulation of system functions is used for malware detection, then detection capability is maintained, but the process becomes reactive, error-prone, and expensive
Solution Approach 1:
The system automatically generates simulation logic through data mining and machine learning, eliminating the need for manual creation. The emulation data assessor autonomously profiles operating environments, identifies system function calls, and generates emulation tables without human intervention, making the system self-sufficient and cost-effective
Solution Approach 2:
Manual simulation processes are replaced with automated data mining and machine learning algorithms. The system uses computational approaches to profile operating environments and generate emulation logic, substituting human manual work with automated mechanical processes that are faster, more accurate, and scalable
2Measurement precision
If original OS image licensing is used for emulation, then accurate simulation is achieved, but performance costs increase significantly
Solution Approach 1:
The system extracts only the essential simulation logic needed for accurate emulation by profiling the operating environment and identifying critical system function calls. Instead of using the entire OS image, it extracts and models only the relevant components, reducing performance overhead while maintaining accuracy
Solution Approach 2:
The system changes the approach from full OS emulation to selective function emulation by parameterizing which system functions need to be simulated. It dynamically profiles and identifies the specific function calls and parameters relevant to the application, emulating only those necessary components rather than the entire operating system
3Productivity
If data-mining and machine-learning strategies are used to automatically model simulation logic, then manual simulation is eliminated and performance impact is reduced, but system complexity increases
Solution Approach 1:
The complex task of creating simulation logic is segmented into distinct automated modules: profiling module for environment analysis, data mining module for pattern recognition, machine learning module for logic generation, and emulation table generation module. This segmentation manages complexity by breaking down the overall process into specialized, manageable components
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to identify an application, run the application, log the parameters for each function call of the application, and store the logged parameters in an emulation table. The logged parameters can include a function call, input parameters, and output parameters. The emulation table can be used to simulate execution of an application without having to actually run the application.