Functionality-Based Malware Detection via Operational Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus methods struggle to detect malware that employs polymorphic or metamorphic code, as these codes constantly change their signatures, evading detection by traditional signature-based recognition systems.
Innovation Solution
A system and method that define code by its functionality, rather than its signature, by breaking down code into operational components, creating lists of functional operations, and generating functionality-based signatures, allowing for recognition regardless of polymorphic or metamorphic transformations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to identify malware, then detection accuracy for known malware is improved, but detection reliability deteriorates when malware uses polymorphic or metamorphic code to change its signature
Solution Approach 1:
Instead of detecting malware by its signature (code structure), the patent inverts the approach by detecting malware by its functional behavior. The system monitors what the code does rather than what it looks like, tracking functional operations such as file modifications, registry changes, and system calls. This inversion allows reliable detection of polymorphic and metamorphic malware since their functional behavior remains consistent even when their code signatures change.
Solution Approach 2:
The patent changes the detection parameter from static code signatures to dynamic functional operations. By monitoring functional parameters such as API calls, system operations, and behavioral patterns, the system can detect malware regardless of how its code signature evolves. This parameter change enables the detection system to adapt to polymorphic and metamorphic transformations while maintaining reliable identification of malicious intent.
2Object-affected harmful factors
If code is encrypted to achieve polymorphism and evade detection, then malware evasion capability is improved, but code usability deteriorates since not all code can be encrypted
Solution Approach 1:
The patent extracts the decryption engine's functional operations from the encrypted malware payload. By monitoring the specific functional operations that the decryption engine performs (such as calling specific APIs, accessing certain system resources, or executing particular sequences of operations), the system can detect malware even when most of the code is encrypted. This extraction allows detection of the essential functional behavior without requiring decryption of the entire codebase.
Solution Approach 2:
The patent introduces functional operation monitoring as an intermediary between the encrypted malware and the detection system. Instead of directly analyzing the encrypted code or its signature, the system monitors the intermediary functional operations that occur during execution. This intermediary layer allows detection of malicious intent while the malware remains encrypted and maintains its usability.
3Speed
If traditional signature recognition is used to locate malicious code, then detection speed is improved for known signatures, but detection precision deteriorates when malware constantly changes its signature through polymorphism
Solution Approach 1:
The patent implements continuous monitoring of functional operations during code execution rather than relying on discrete signature matching. By continuously tracking functional behavior such as system calls, file operations, and registry modifications, the system maintains both high detection speed and precision. The continuous functional monitoring allows immediate detection of malicious actions regardless of how the malware's signature changes, eliminating the trade-off between speed and precision that plagues signature-based systems.
Data Source
AI summary
A system and method for defining code by its functionality is disclosed. The technology initially accesses a portion of code. Once the portion of code is accessed at least one functional operation embedded in the code is determined. When the functional operation in the code is determined, the portion of code is then defined by the functional operation. In so doing, the portion of code can be defined by functional operation without requiring the consideration of any semantics related to the portion of code.