Emulation System for Countering Malware Anti-Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in effectively counteracting anti-emulation techniques used by malicious programs, which exploit limitations in emulation processes to evade detection, leading to incomplete and inaccurate emulation of system API functions.
Innovation Solution
A method and system that employ sequential emulation of application program instructions in both user-mode and kernel-mode environments, with a standard emulator module, an instruction review module, a system call emulator module, and an analyzer module to detect malicious code by accurately tracking processor and memory states during API function calls, allowing for more comprehensive and accurate emulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complete system API emulation is implemented, then detection accuracy is improved, but emulation time and system complexity increase significantly
Solution Approach 1:
The patent segments the emulation process into two distinct modes: sequential instruction emulation for normal execution and fast API call emulation for system function execution. This segmentation allows the system to apply different emulation strategies to different parts of the program execution, achieving both accuracy and efficiency.
Solution Approach 2:
The patent implements dynamic switching between emulation modes based on the type of instruction being executed. The system dynamically transitions from sequential emulation mode to fast API emulation mode when detecting API calls, and back to sequential mode afterward, optimizing performance based on runtime conditions.
2Measurement precision
If complete system API emulation is implemented, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent divides the emulation system into separate modules: a sequential emulator for instruction-level emulation and a fast API emulator for system function emulation. This modular segmentation reduces overall system complexity by allowing each module to be optimized independently for its specific function.
Solution Approach 2:
The patent introduces an intermediary mechanism (the instruction review module and mode switching logic) that coordinates between the sequential emulator and fast API emulator. This intermediary manages the complexity of mode transitions and API call handling, simplifying the overall system architecture.
3Measurement precision
If sequential emulation of all instructions is performed, then emulation accuracy is improved, but productivity decreases
Solution Approach 1:
The patent implements dynamic adaptation of emulation speed based on instruction type. The system operates in high-accuracy sequential mode for normal instructions and switches to high-speed fast emulation mode for API calls, optimizing the balance between accuracy and productivity in real-time.
Solution Approach 2:
The patent changes the emulation parameter (emulation speed/accuracy level) based on the execution context. For sequential instructions, full sequential emulation is applied; for API calls, fast emulation parameters are used, effectively adjusting system behavior to match operational requirements.
Data Source
Figure 1A~1B
Figure 1C
Figure 1D
AI summary
Instructions of an application program are emulated such that they are carried out sequentially in a first virtual execution environment that represents the user-mode data processing of the operating system. A system API call requesting execution of a user-mode system function is detected. In response, the instructions of the user-mode system function called by the API are emulated according to a second emulation mode in which the instructions of the user-mode system function are carried out sequentially in a second virtual execution environment that represents the user-mode data processing of the operating system, including tracking certain processor and memory states affected by the instructions of the user-mode system function. Results of the emulating of the application program instructions according to the first emulation mode are analyzed for any presence of malicious code.