Gateway Worm Detection via Disassembly and Threat Weighting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious code, such as worms and viruses, are inadequate for protecting networks from unknown threats and are particularly ineffective in detecting worm attacks that exploit vulnerabilities like buffer overflows, as they rely on signature-based detection and are slow to respond to new threats.
Innovation Solution
A system and method that monitors data streams at a network gateway for suspicious data, disassembles it, assigns threat weights to instructions, and accumulates these weights to detect malicious code, allowing for proactive blocking or alerting without requiring pre-defined signatures, using a disassembler and threat weight analyzer to identify and neutralize potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based anti-virus scanning is used to detect malicious code, then detection accuracy for known viruses is improved, but response speed to new worms deteriorates and adaptability to unknown threats worsens
Solution Approach 1:
The system performs preliminary disassembly of data streams at the network gateway level before malicious code can execute or spread. By disassembling and analyzing code structure in advance, the system identifies worms based on their structural characteristics rather than waiting for signature matches, enabling proactive detection of novel threats.
Solution Approach 2:
The patent introduces a disassembler and threat weight analyzer as intermediary components between raw data streams and detection decisions. These intermediaries transform binary data into disassembled instructions and calculate threat weights, bridging the gap between raw network traffic and security detection without requiring pre-defined virus signatures.
2Reliability
If comprehensive code analysis is performed to detect all malicious code variants, then detection capability is improved, but processing time and system complexity increase
Solution Approach 1:
The system applies different analysis depths to different portions of data streams based on local characteristics. The disassembler focuses on suspicious portions identified by monitoring, and threat weights are assigned selectively to specific instructions rather than analyzing every byte uniformly, reducing overall complexity while maintaining detection reliability.
Solution Approach 2:
The patent changes the parameter of analysis from binary matching (signature-based) to quantitative threat weight accumulation. By transforming discrete signature matching into a continuous threat weight calculation system, the patent simplifies the detection mechanism while improving its ability to handle diverse malicious code variants.
3Measurement precision
If disassembly and threat weight accumulation are performed on all data streams, then detection accuracy is improved, but processing speed deteriorates
Solution Approach 1:
The system performs partial disassembly and threat weight accumulation only on suspicious portions of data streams rather than analyzing every byte completely. This partial action approach maintains detection accuracy for malicious code while reducing the processing burden on benign traffic, thereby preserving processing speed.
Solution Approach 2:
The monitoring mechanism allows the system to skip acceptable data in data streams and focus disassembly efforts only on suspicious portions. This skipping approach rushes through benign traffic quickly while applying thorough analysis only where needed, maintaining both accuracy and processing speed.
Data Source
AI summary
A method for detecting malicious code in a stream of data traffic input (400) to a gateway in a data network by monitoring for suspicious data in the stream of data traffic (407). Upon detecting the suspicious data, an attempt is made to disassemble the suspicious data (403) and a treat weight is assigned for each instruction. The attempt to disassemble is initiated at initial instructions each with a different offset within the suspicious portion of data. The threat weights are accumulated respectively for each branch option in the disassembled code (403), producing respectively an accumulated threat weight for each branch option. When the accumulated threat weight exceeds a previously defined threshold level, an alert is generated and/or traffic is blocked from the source of the malicious code.