Execution Profile Assembly for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional electronic security approaches are reactive and struggle to detect malware inserted into event processing routines through various methods, leaving systems vulnerable to unknown threats and requiring constant updates to keep pace with evolving malware techniques.
Innovation Solution
A system that utilizes branch records, inline hook engines, test event generators, and code owner locators to assemble execution profiles, allowing for the detection of malware insertion methods regardless of the technique used, and validates the legitimacy of API invokers by generating test events and placing hooks to monitor and analyze code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional reactive security approaches are used to detect known threats, then detection accuracy for known malware is improved, but the system remains vulnerable to unknown threats and requires constant updates
Solution Approach 1:
The system performs preliminary actions by recording branch records and assembling execution profiles before actual malware execution occurs. By pre-establishing baseline execution profiles for legitimate code and monitoring deviations, the system can detect unknown threats without requiring constant updates to threat signatures.
Solution Approach 2:
The patent introduces execution profiles as an intermediary mechanism between the monitored code and the security analysis. These profiles serve as a mediator that captures the actual execution behavior of code, allowing the system to analyze whether code is performing its intended function or exhibiting malicious behavior, regardless of whether the threat is known or unknown.
2Productivity
If branch records are used to monitor code execution, then execution tracking capability is improved, but depth limitations of branch records reduce detection effectiveness
Solution Approach 1:
The patent segments the execution monitoring process into multiple components: branch record collection, execution profile assembly, and deviation analysis. By dividing the monitoring task into these segments, the system can overcome the depth limitations of individual branch records by aggregating multiple records into comprehensive execution profiles that provide deeper inspection capability.
Solution Approach 2:
The system transitions from analyzing single branch records in isolation to analyzing execution profiles that aggregate branch records across multiple dimensions (different code paths, different execution contexts). This dimensional expansion allows the system to achieve deeper detection effectiveness without being constrained by the depth limitation of individual branch records.
3Reliability
If reactive security updates are implemented to keep pace with malware, then protection against latest threats is improved, but system complexity and maintenance burden increase
Solution Approach 1:
The system implements self-service by automatically assembling execution profiles from recorded branch records and comparing actual execution against expected behavior. This automated approach reduces the need for manual security updates and maintenance, as the system continuously monitors and analyzes execution patterns without requiring constant human intervention to update threat databases or signatures.
Data Source
AI summary
Technologies for assembling an execution profile of an event are disclosed. The system and method may include recording a plurality of branch records, generating a first test event substantially identical to the event, verifying legitimacy of an owner of a code segment associated with the event, establishing an initial point of an execution chain associated with the event, establishing a final point of the execution chain associated with the event, analyzing branch records for an address associated with the code segment, installing a plurality of primary monitors within the execution chain associated with the event, and triggering the plurality of primary monitors.