Emulation System for Malware Analysis via Selective System Call Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors compress and encrypt executable programs to evade detection, making it difficult for researchers to identify unwanted behavior, as existing technologies struggle to effectively reverse engineer and emulate malicious code.
Innovation Solution
An emulation system that loads files into memory, emulates instructions, identifies system calls, and passes harmless system calls to the operating system for direct execution while emulating sensitive ones, allowing for secure execution within a sandbox environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malware authors compress and encrypt executable programs to obfuscate code, then detection evasion capability is improved, but reverse engineering difficulty increases
Solution Approach 1:
The patent introduces an intermediary decryption module that acts as a bridge between the encrypted malware and the analysis system. This module automatically decrypts and decompresses the obfuscated code, allowing researchers to analyze the original malicious behavior without manually reversing the encryption, thus resolving the contradiction between detection evasion and analysis difficulty
Solution Approach 2:
The patent replaces manual reverse engineering processes with automated software agents that can programmatically decrypt, decompress, and analyze malware. This substitution of mechanical human analysis with automated computational systems dramatically reduces the time and expertise required to analyze obfuscated malware
2Object-affected harmful factors
If code is included to prevent debugging and strict emulation, then malware protection capability is improved, but analysis time increases
Solution Approach 1:
The patent implements preliminary actions by pre-configuring the sandbox environment with debugging and emulation bypass capabilities before malware execution. The system proactively disables anti-debugging techniques and prepares a controlled execution environment that allows analysis despite malware protection mechanisms, thus reducing analysis time without compromising security
Solution Approach 2:
The patent creates a virtual copy of the malware execution environment through sandboxing, where the malware runs in an isolated simulated context. This copying approach allows researchers to study malware behavior in a safe environment that mimics real systems but lacks the protective mechanisms that would interfere with analysis
3Reliability
If all system calls are emulated rather than passed to operating system, then security control is improved, but execution efficiency decreases
Solution Approach 1:
The patent applies local quality by differentiating the handling of system calls based on their security sensitivity. Non-sensitive system calls are passed directly to the operating system for efficient execution, while sensitive system calls are intercepted and emulated within the sandbox. This localized approach to system call handling optimizes both security control and execution efficiency
4Measurement precision
If researchers manually reverse engineer virus samples, then detection accuracy is improved, but time consumption increases
Solution Approach 1:
The patent replaces manual reverse engineering with automated analysis agents that use software-based techniques to decrypt, decompress, and analyze malware behavior. These automated systems maintain high detection accuracy by systematically examining all code paths while dramatically reducing the time required compared to manual analysis by researchers
Data Source
AI summary
An emulation system, method, and computer program product are provided for passing system calls to an operating system for direct execution. In operation, a file is loaded into memory and instructions associated with the loaded file are emulated. Furthermore, system calls resulting from the emulation are identified. Still yet, at least a portion of the system calls are passed to an operating system for direct execution thereof. In addition, application programming interfaces are provided for external components to access, to monitor and to control the aforementioned system.