Malware Detection via Import-Load Signature Deviations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware technologies face difficulties in detecting malicious code that modifies in-memory processes, as these modifications do not leave signatures on disk and often evade detection by obfuscating or modifying behaviors.
Innovation Solution
Generating and comparing baseline import-load signatures of trusted executable images in a controlled environment to identify deviations when sample programs are run, allowing for the detection of malicious code by analyzing differences in import resolutions and load patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavioral tracking is used to detect malicious in-memory process modification, then detection capability is improved, but malware can evade detection by obfuscating or modifying behaviors
Solution Approach 1:
The system performs preliminary actions by generating baseline import-load signatures for trusted executable images before they are potentially infected. These baselines are stored and used for later comparison to detect modifications, allowing the system to identify malicious changes even when malware obfuscates its behavior.
Solution Approach 2:
The system creates copies of the import-resolution and library-loading behaviors in the form of cryptographic hash signatures. Instead of directly monitoring and analyzing complex behavioral patterns that can be obfuscated, the system copies the essential characteristics into immutable signature representations that can be reliably compared to detect deviations.
2Reliability
If traditional file-based signature scanning is used, then detection of known malware is improved, but in-memory malware without on-disk presence cannot be detected
Solution Approach 1:
The system transitions from file-based detection (one dimension) to in-memory behavioral detection (another dimension). By monitoring import resolutions and library loads within the memory space of running processes, the system can detect malware that exists only in memory without requiring on-disk presence or traditional file signatures.
Solution Approach 2:
The system introduces an intermediary approach by using cryptographic hash functions as mediators between the executable image code and the detection process. Instead of directly scanning files or interpreting complex behavioral patterns, the hash function transforms the import-load behaviors into comparable signature representations that bridge the gap between file-based and behavior-based detection.
3Reliability
If comprehensive behavioral monitoring is implemented to detect in-memory modifications, then detection coverage is improved, but system complexity and overhead increase
Solution Approach 1:
The system extracts only the essential and most reliable aspects of program behavior—specifically import resolutions and library loading operations—rather than monitoring all possible behavioral parameters. This selective extraction reduces system complexity while maintaining effective detection coverage for in-memory malware.
Solution Approach 2:
The system changes the parameter representation from complex behavioral patterns to simplified cryptographic hash signatures. By transforming the detection parameters into hash values based on specific instructions and operands, the system reduces complexity while preserving the ability to detect modifications through signature comparison.
Data Source
AI summary
Trusted executable images are run in a controlled environment, such as a dynamic malware analysis platform. For each trusted executable image, a corresponding baseline import-load signature is generated. This can be done by applying a cryptographic hash function to the specific instructions which resolve imports and/or load libraries, and their operands. Sample programs are run in the controlled environment and tested for maliciousness. Any executable image run by a given sample program in the controlled environment is identified, and an import-load signature of the executable image when run by the sample program is generated. The import-load signature of the executable image when run by the sample program is compared to the corresponding stored baseline import-load signature for the same executable image. The sample program is adjudicated as being benign or malicious based on at least the results of the comparison.