Emulator Memory Buffering for Malware Signature Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern malware evades detection by wiping out its preparation stage code and data, making it difficult for existing malware detection systems to generate effective signatures.
Innovation Solution
A memory buffering manager in an emulator copies ranges of memory before and after suspicious API calls to a buffer inaccessible to the code sample, allowing for analysis and signature generation without being wiped out, using API call classification and memory scanning to identify malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware wipes out its preparation stage code and data to evade detection, then malware detection capability deteriorates, but the preparation stage still contains detectable patterns that can be captured through memory copying before wiping occurs
Solution Approach 1:
The system performs preliminary action by copying memory ranges before and after suspicious API calls to a buffer before the malware can wipe out its preparation stage code and data. This preliminary capture preserves the detectable patterns in the preparation stage, enabling signature generation even though the malware attempts to eliminate traces of itself.
Solution Approach 2:
The invention uses copying by creating a buffer that copies memory ranges from the emulator's memory space. This copy mechanism preserves the preparation stage code and data that would otherwise be wiped out by the malware, allowing analysis and signature generation from the copied data rather than the original volatile memory.
2Reliability
If the buffer is made inaccessible to the code sample, then the code sample cannot wipe the buffer contents, but this requires additional memory management complexity
Solution Approach 1:
The system segments memory accessibility by creating a separate buffer that is inaccessible to the code sample, effectively dividing the memory space into accessible and inaccessible regions. This segmentation ensures that the buffer contents cannot be wiped by the malware while maintaining a relatively simple implementation through standard memory protection mechanisms.
3Measurement precision
If multiple API calls are classified as suspicious, then more memory ranges are copied to the buffer, increasing analysis coverage, but this increases processing time and computational resources
Solution Approach 1:
The system applies partial action by copying only the memory ranges before and after suspicious API calls rather than the entire memory space. This selective copying provides sufficient analysis coverage to generate accurate signatures while minimizing the processing time and computational resources required compared to a full memory dump approach.
Data Source
AI summary
API calls made by a code sample executing in an emulator are analyzed. Specific ones of the analyzed API calls are classified as meeting a threshold level of suspicion of being made by malware. In response to a specific API call being classified as meeting the threshold, a range of memory before and after the return address of the classified API call is copied to a buffer that is not accessible to the code sample. The copied range of memory in the buffer that is not accessible to the code sample is scanned, and a signature corresponding to the code sample is generated. The generated signature can be used for signature based malware detection, in order to detect one or more instances of malware. In response to detecting malware, one or more security actions can be performed.