Malicious Executable Overlay Detection via Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems fail to detect malicious executable files that hide their payload in overlays, as these overlays are not loaded into memory during execution and are not detected by conventional detection mechanisms.
Innovation Solution
A method involving static analysis of executable files to extract and analyze their overlays, using machine learning models to classify the files as malicious or benign based on properties such as overlay existence, size, content, and reputation, allowing for the identification of potentially malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus detection mechanisms are used, then detection efficiency and probability are high for loaded code, but malicious payloads hidden in overlays are not detected
Solution Approach 1:
The patent segments the executable file analysis into two distinct parts: the main file body and the overlay section. By separating the detection process, the system can apply different analysis methods to each segment, specifically targeting the overlay with specialized detection techniques that account for its unique characteristics (not being loaded into memory, appended after the main executable content).
Solution Approach 2:
The patent introduces a new dimension to malware detection by examining the overlay section, which exists in a different state than traditionally analyzed code. The overlay is detected as a separate layer appended to the executable file, creating a multi-layered detection approach that goes beyond conventional single-dimension file analysis.
2Object-affected harmful factors
If overlays are used to hide malicious payloads, then malware can evade detection by existing mechanisms, but the file structure becomes more complex
Solution Approach 1:
The patent performs preliminary detection of the overlay section before the executable file is run or during static analysis. By identifying and analyzing the overlay in advance, the system can detect malicious payloads hidden in this section without waiting for execution, thereby preventing malware evasion while maintaining a manageable analysis process.
Solution Approach 2:
The patent introduces an intermediary analysis layer that specifically targets the overlay section. This intermediary detection mechanism acts as a bridge between the main executable analysis and the hidden overlay content, applying specialized techniques to extract and analyze the overlay without disrupting the overall file structure or requiring full execution.
3Loss of time
If static analysis is performed on overlays, then malicious content can be detected without execution, but the analysis process becomes more complex
Solution Approach 1:
The patent segments the static analysis process to focus specifically on the overlay section rather than analyzing the entire executable file in detail. This targeted approach reduces the overall analysis time by concentrating computational resources on the critical overlay portion where hidden malicious payloads are most likely to be found.
Solution Approach 2:
The patent applies partial analysis to the overlay section, focusing on key indicators and characteristics that are most indicative of malicious content. Rather than performing exhaustive analysis on every byte of the overlay, the system applies selective detection techniques that achieve effective malware identification with reduced computational overhead and time investment.
Data Source
AI summary
Embodiments of the present systems and methods may decide if a software file is malicious or benign, using properties of the file's overlay, if existing. For example, in an embodiment, a computer-implemented method for identifying malware in computer systems may comprise receiving a plurality of executable files labeled as being malicious or benign, training a machine learning model using properties extracted from overlays associated with each of the plurality of received labeled executable files, receiving an executable file that is not labeled, determining whether the received unlabeled executable file is malicious or benign using the trained machine learning model based on properties extracted from an overlay associated with the received unlabeled executable file, and transmitting information identifying the received unlabeled executable file as malicious when the received unlabeled executable file is determined to be malicious.