Execution Profiling for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional electronic security approaches are reactive and struggle to detect malware inserted into event processing routines through various methods, leaving devices vulnerable to unknown threats and requiring frequent updates to keep pace with evolving malware techniques.
Innovation Solution
A system comprising a processor, security module, and execution profiling module that monitors execution profiles to detect unauthorized software without relying on signatures or prior knowledge, using hardware and software extensions to identify malicious activity, such as return-oriented programming, and validate API invocations, enabling detection of malware regardless of insertion method.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional reactive security approaches are used to detect known threats, then protection against identified malware is improved, but vulnerability to unknown threats increases and frequent updates are required
Solution Approach 1:
The system performs preliminary action by establishing baseline execution profiles of legitimate software before malware can infect the system. These profiles capture normal behavior patterns, function call sequences, and execution characteristics. When malware is introduced, it deviates from these pre-established baselines, enabling detection without requiring updates to signature databases.
Solution Approach 2:
The system transitions from static signature-based detection to dynamic behavior-based detection. Execution profiles are continuously monitored and compared against baselines during runtime, allowing the system to adapt to new threats in real-time without requiring manual updates. The detection mechanism dynamically adjusts to recognize deviations from normal execution patterns.
2Measurement precision
If signature-based detection methods are used, then detection of known malware is improved, but detection of malware using unknown insertion methods fails
Solution Approach 1:
The execution profiling mechanism serves as a universal detection approach that works across multiple malware insertion methods without requiring method-specific detection rules. By monitoring fundamental execution characteristics such as function call patterns, control flow changes, and API invocation sequences, the system detects malware regardless of whether it uses API hooks, inline hooks, return-oriented programming, or other insertion techniques.
Solution Approach 2:
The system changes the detection parameter from static malware signatures to dynamic execution behavior parameters. Instead of searching for specific malware code patterns, the system monitors parameters such as function call frequency, execution timing, control transfer patterns, and API usage sequences. These parameter changes enable detection of malware with unknown signatures and insertion methods.
3Reliability
If constant vigilance and updating are maintained to keep pace with malware advancements, then protection effectiveness is improved, but system complexity and resource requirements increase
Solution Approach 1:
The system implements self-service by automatically establishing execution baselines during normal operation and autonomously detecting deviations without requiring manual intervention. The profiling mechanism continuously monitors execution patterns and automatically compares them against established baselines, enabling the system to maintain protection effectiveness without constant human vigilance or manual updates to detection rules.
Solution Approach 2:
The system uses feedback by continuously monitoring execution profiles and comparing them against established baselines. When deviations are detected, the system generates alerts or takes corrective actions. This closed-loop feedback mechanism maintains protection effectiveness automatically, reducing the need for manual intervention and simplifying system maintenance while keeping pace with evolving threats.
Data Source
AI summary
Technologies for assembling an execution profile of an event are disclosed. The technologies may include monitoring the event for a branch instruction, generating a callback to a security module upon execution of the branch instruction, filtering the callback according to a plurality of event identifiers, and validating a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.