File Emulation Logging via Breakpoints and Intermediate Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file emulation systems struggle to accurately log function calls when dealing with instructions different from machine instructions, such as those in intermediate code or scripts, leading to incomplete logs and reduced detection rates of malicious files.
Innovation Solution
A system and method for emulating file execution that generates an image of the file, detects known sets of instructions, inserts break points, and logs records of executed instructions, allowing for accurate logging of function calls even when instructions are not in machine code format, by imitating the operating system loader and using an emulation log.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the emulator performs changes in the IAT section for machine instructions, then the logging of function calls is accurate for machine instructions, but no information is saved in the IAT for instructions different from machine instructions (intermediate code or scripts)
Solution Approach 1:
The patent introduces an intermediary mechanism (emulation log) that captures function call information for both machine instructions and non-machine instructions (intermediate code, scripts). This intermediary log serves as a mediator between the emulator and the IAT, allowing comprehensive logging of all instruction types without relying solely on traditional IAT mechanisms that only work for machine instructions.
Solution Approach 2:
The patent segments the logging function into two parts: the traditional IAT mechanism for machine instructions and a separate emulation log system for non-machine instructions. This segmentation allows each logging mechanism to specialize in its appropriate instruction type, resolving the contradiction between accuracy for machine instructions and coverage for all instruction types.
2Reliability
If the emulator logs all function calls for complete detection, then the detection rate of malicious files improves, but the complexity of the emulation system increases when handling multiple instruction types
Solution Approach 1:
The emulation log is designed as a universal logging mechanism that handles multiple instruction types (machine instructions, intermediate code, scripts) through a single unified system. This multi-functional approach allows the system to achieve complete detection across all instruction types without requiring separate complex logging systems for each instruction type, thereby improving reliability while managing complexity.
3Manufacturing precision
If the emulator processes files with intermediate code or scripts using OS loader steps, then the emulation is more accurate, but the time required for emulation increases
Solution Approach 1:
The patent performs preliminary actions by pre-processing files to identify and categorize different instruction types (machine instructions, intermediate code, scripts) before emulation begins. This preliminary classification allows the emulator to apply optimized processing paths for each type, maintaining high emulation accuracy for complex instruction types while reducing overall emulation time through efficient handling strategies.
Data Source
AI summary
Disclosed are systems and methods for emulating execution of a file based on emulation time. In one aspect, an exemplary method comprises, generating an image of a file, emulating an execution of instructions from the image for a predetermined emulation time, the emulation including: when an emulation of an execution of instruction from an image of another file is needed, generating an image of the another file, detecting known set of instructions in portions read from the image, inserting a break point into a position in the generated image corresponding to a start of the detected set of instructions, emulating execution of the another file by emulating execution of instructions from the generated image, and adding corresponding records to an emulation log, and reading a next portion from the image of the another file and repeating the emulation until the predetermined emulation time has elapsed.