Finite-State Malware Behavior Analysis for Faster Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems face high computing resource consumption, low analysis speed, inflexibility in updating signatures, and lack of threat prediction capabilities, leading to inefficient and ineffective malware detection.
Innovation Solution
A system utilizing a virtual machine with a behavior analyzer implemented via high-level programming instructions, which includes a behavior detection module, event processing module, event correlator, and threat handler, to analyze system events and identify malicious activity by changing finite-state machine states based on a transition table and repository of expected states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional analyzers perform a stack of operations per user, per process, per application and match with known behavior signature, then malware detection capability is achieved, but computing resource consumption is high and analysis speed is low
Solution Approach 1:
The system segments the behavior analysis process into distinct finite states representing different stages of malware execution. By dividing the analysis into discrete states and transitions, the system processes events more efficiently without sacrificing detection accuracy, thus improving analysis speed while maintaining malware detection capability.
Solution Approach 2:
The system performs preliminary action by pre-defining finite states and transition rules that represent expected malware behavior patterns. This allows the analyzer to quickly evaluate events against pre-established criteria rather than performing comprehensive analysis from scratch, thereby increasing analysis speed while preserving detection reliability.
2Reliability
If conventional analyzers perform comprehensive stack operations for behavior analysis, then detection accuracy is maintained, but computing resource consumption increases
Solution Approach 1:
The system extracts and focuses only on the essential events and parameters relevant to malware detection by filtering events at each finite state transition. This selective approach removes unnecessary computational overhead while preserving detection accuracy by concentrating resources on critical analysis points.
Solution Approach 2:
The system applies partial action by performing behavior analysis only on specific events that trigger finite state transitions, rather than analyzing all events comprehensively. This selective analysis maintains detection accuracy for malicious activities while reducing overall computing resource consumption.
3Stability of the object's composition
If behavior analyzers use fixed signatures and detection rules, then consistent detection is achieved, but flexibility to update signatures is reduced
Solution Approach 1:
The system implements dynamics by allowing the finite state machine structure to remain stable while enabling dynamic updates to transition rules and event filters. This allows consistent detection based on established states while providing flexibility to adapt to new malware variants by updating transition criteria without restructuring the entire analysis framework.
Solution Approach 2:
The system enables parameter changes by allowing modification of event filters, transition conditions, and state definitions in response to emerging threats. This maintains consistent detection through stable finite state structure while adapting to new malware patterns by changing specific parameters such as event types monitored or transition thresholds.
4Device complexity
If conventional analyzers lack threat prediction features, then system simplicity is maintained, but ability to predict and track threat risk is lost
Solution Approach 1:
The system performs preliminary action by establishing finite states that represent progressive levels of malicious activity and defining transition rules that predict future malicious behavior based on current event patterns. This enables threat prediction and risk tracking while maintaining relative system simplicity through the structured finite state framework.
Data Source
AI summary
A system and method are disclosed for identifying malicious activity on a target device based on behavior analysis of the target device. The system includes a behavioral analyzer run on a virtual machine connected to the target device. The virtual machine collects system events and parameters from the target device and run a script, independent of the target device, to detect a threat. The script is a set of instructions executed to analyze behavior of an object by processing and correlating the events. The script includes a rule structure which stores signatures and expressions of the known malwares. By correlating the selected event parameters with known malware parameters, it is determined whether the event imposes a threat or not. A finite state machine is used for the state transition table.