Emulation Engine Detects Multi-Component Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Heuristic analysis techniques fail to detect multi-component malware, where malicious code is distributed across several executable components, each exhibiting benign behavior, making it difficult for antivirus software to identify the overall malicious actions.
Innovation Solution
A system and method that includes an emulation engine with a system emulator and program emulator to simulate the execution of computer programs in an isolated environment, detecting system calls and comparing them with known malicious patterns to identify malicious behavior, even when individual components appear benign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If heuristic analysis is performed on individual executable components, then detection accuracy for single-component malware is improved, but detection capability for multi-component malware deteriorates
Solution Approach 1:
The patent segments the analysis process into two levels: individual component analysis and holistic program analysis. The system divides the malware into executable components for separate emulation and analysis, then reconstructs the complete program behavior by integrating results from all components. This segmentation allows detection of both isolated malicious components and coordinated multi-component attacks.
Solution Approach 2:
The patent merges individual component analyses into a unified holistic analysis. By combining detection results from multiple executable components and analyzing their interactions, the system achieves comprehensive detection capability that neither individual analysis nor simple aggregation could provide alone.
2Reliability
If comprehensive emulation of all executable components is performed, then detection of distributed malicious code is improved, but computational resources and analysis time increase
Solution Approach 1:
The patent performs preliminary emulation and analysis of individual executable components before conducting holistic program analysis. This preliminary action identifies suspicious components early, allowing the system to focus subsequent comprehensive analysis on high-risk areas and reduce overall analysis time while maintaining detection capability.
Solution Approach 2:
The patent implements a tiered analysis approach where not all components receive equal analysis depth. Components showing suspicious behavior during preliminary analysis undergo more intensive holistic analysis, while clearly benign components receive minimal analysis. This partial action strategy maintains high detection capability while reducing unnecessary computational overhead.
3Ease of operation
If individual components exhibit benign behavior, then false positive rate increases, but actual malicious behavior may be hidden
Solution Approach 1:
The patent merges individual component behaviors into a holistic program behavior analysis. By examining how components interact and coordinate with each other, the system can detect malicious patterns that emerge from component collaboration, even when individual components appear benign in isolation. This merging reveals the true nature of multi-component malware.
Solution Approach 2:
The patent implements feedback loops where detection results from individual components inform the holistic analysis, and holistic analysis results feed back to re-evaluate individual components. This iterative feedback process allows the system to adjust its detection thresholds and strategies based on the overall program context, reducing false positives while maintaining sensitivity to hidden malicious behavior.
Data Source
AI summary
Malicious behavior of a computer program is detected using an emulation engine, an event detector and an event analyzer. The emulation engine includes a system emulator configured to emulate, in an isolated computer environment, at least a part of a computer system and a program emulator configured to emulate in the isolated computer environment execution of the computer program, including execution of a plurality of executable components of the computer program, such as execution processes and threads. The event detector is configured to monitor events being generated by two or more of the executable components. The event analyzer is configured to determine, substantially in real time, based at least on one or more events generated by each of two or more of the plurality of executable components whether or not the computer program exhibits malicious behavior, wherein individually one or more of the plurality of executable components may exhibit benign behavior.