Executable Code Evaluator for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malware in executable code, such as static and dynamic analysis, are ineffective in identifying packed or encrypted malicious code, particularly in Portable Executable (PE) files, as they fail to detect unknown or evolving threats.
Innovation Solution
An executable code evaluator (ECE) is implemented using machine learning models, specifically convolutional neural networks, to analyze executable code by extracting feature vectors from memory dumps, filtering known functions, normalizing mnemonics, and training models to detect anomalies, thereby improving detection efficacy even for code that evades conventional analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional static and dynamic analysis methods are used to detect malware, then detection of known malware is possible, but detection of packed or encrypted malicious code fails
Solution Approach 1:
The system performs preliminary actions by extracting features from executable code before full execution, creating a static analysis framework that prepares data for later detection. This includes extracting control flow graphs, call graphs, and other structural features that can be analyzed without running the potentially malicious code, thus preventing detection of packed/encrypted code while maintaining reliability for known threats.
Solution Approach 2:
The patent introduces an intermediary machine learning model that acts as a mediator between the raw executable code and the detection decision. This model processes extracted features through multiple layers of transformation, enabling the system to detect both known malware patterns and unknown malicious behaviors by learning complex relationships in the feature space that conventional analysis methods miss.
2Measurement precision
If machine learning models are trained with comprehensive feature vectors, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system extracts only the most relevant features from the executable code, such as control flow graph properties, call graph characteristics, and specific instruction patterns, rather than analyzing the entire code base. This selective extraction maintains detection accuracy by focusing on discriminative features while significantly reducing processing time and computational resource requirements.
Solution Approach 2:
The analysis process is segmented into multiple independent stages: feature extraction, feature selection, model training, and detection. Each stage processes specific subsets of data and can be optimized independently, allowing parallel processing and reducing overall latency while maintaining comprehensive analysis for high accuracy detection.
3Productivity
If traditional analysis methods are used, then processing speed is fast for simple cases, but detection efficacy fails for evasive malware
Solution Approach 1:
The system employs dynamic analysis techniques by executing the code in a controlled sandbox environment and observing its behavior, including system calls, registry modifications, and file operations. This dynamic approach maintains high processing speed through automated execution while achieving reliable detection of evasive malware that attempts to hide its malicious intent through packing or encryption.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed to improve detection of malware in executable code. Examples disclosed herein include an apparatus comprising: a log file filtration controller to exclude at least one known clean function from a log file to generate a filtered log file; a log file normalization controller to normalize mnemonics of functions in the filtered log file to generate normalized functions; a feature vector generation controller to populate a feature vector with n-gram groupings of the normalized functions; and a machine learning engine to train a machine learning model with the feature vector, the machine learning model to be deployed to an end-user device to detect malware in executable code.