Evasive Malware Detection via Control Transfer Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Evasive malware techniques, such as using sleep calls, wait loops, and sandbox detection methods, hinder the detection of malicious software in sandbox environments, leading to inefficiencies and high overheads in dynamic malware analysis, making it difficult to expose and analyze all execution paths effectively.
Innovation Solution
A method that involves discovering and modifying the original software program to execute previously unrevealed instructions, creating a modified program to explore evasive code paths, and using path exploration techniques to force execution of non-executed code portions, thereby exposing the behavior of evasive malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandbox-based solutions are used to detect malware, then malware detection capability is improved, but evasive malware can prevent detection by sleeping, doing harmless computations, or detecting the sandbox environment
Solution Approach 1:
The system performs preliminary actions by modifying control transfer instructions before malware execution to reveal hidden code paths. By proactively inserting control transfer instructions that force execution of previously unrevealed instructions, the system exposes evasive malware behaviors before they can hide or sleep during normal sandbox timeout periods.
Solution Approach 2:
The system introduces an intermediary mechanism (control transfer instruction modification) between the sandbox environment and the malware execution. This intermediary forces the malware to execute specific code paths that would otherwise remain hidden, acting as a mediator that reveals evasive behaviors without requiring direct confrontation with the malware's detection mechanisms.
2Measurement precision
If the sandbox runs malware for extended periods to detect evasive behavior, then detection accuracy is improved, but the sandbox can only run software for a few minutes before moving to other samples
Solution Approach 1:
The system performs preliminary modification of control transfer instructions to reveal hidden code paths before execution. This preliminary action allows the sandbox to expose evasive malware behaviors in a short time frame rather than requiring extended runtime, enabling the sandbox to process more samples efficiently while maintaining detection accuracy.
Solution Approach 2:
The system skips the time-consuming process of waiting for malware to naturally execute evasive code paths by directly forcing execution of hidden instructions through modified control transfer instructions. This rushing through of the analysis process reveals malware behaviors quickly, reducing the time per sample while maintaining detection precision.
3Reliability
If all code paths are explored to ensure complete malware analysis, then detection completeness is improved, but computational complexity and overhead increase significantly
Solution Approach 1:
The system extracts and focuses only on the critical code paths that contain previously unrevealed instructions, rather than exploring all possible code paths. By selectively modifying control transfer instructions to target specific hidden instructions, the system achieves complete detection of evasive malware behaviors with reduced computational complexity.
Solution Approach 2:
The system applies partial action by selectively revealing only the necessary code paths containing hidden instructions through controlled modification of transfer instructions. This targeted approach provides sufficient action to detect evasive malware without the excessive computational overhead of exploring every possible execution path.
Data Source
AI summary
A method is presented for analyzing an original software program as a potentially evasive malware. The method may comprise discovering at least one revealed instruction in the original software program, where the revealed instructions are not executed when the original software program is run without modification; modifying the original software program to create a modified program that will execute at least one revealed instruction when the modified program is run; and exploring the at least one revealed instruction by running the modified program.