Interpreter Translation Table Morphing for Malware Call Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection tools struggle to identify command execution attacks that exploit vulnerabilities in interpreter-based systems, as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) are insufficient against sophisticated attacks that manipulate relative addressing.
Innovation Solution
Modify translation tables used by interpreters to reference randomized function names and bytecode, and patch programs to use these modified references, while trapping calls to unmodified function names for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If translation tables are modified to reference randomized function names and bytecode, then detection capability against code injection attacks is improved, but system complexity and overhead increase
Solution Approach 1:
The translation table is modified in advance before the interpreter executes the program. By pre-randomizing function names and bytecode references in the translation table, the system prepares the detection mechanism beforehand, so that when malicious code attempts to inject commands, the randomized references already in place prevent the attack from succeeding. This preliminary modification ensures detection capability without adding runtime complexity.
2Reliability
If programs are patched to reference modified function names, then security against command execution attacks is improved, but processing time and computational overhead increase
Solution Approach 1:
Programs are patched during the loading phase or at installation time to reference the modified function names in the randomized translation table. This preliminary patching ensures that when the program executes, it already contains the correct references to the randomized function names, eliminating the need for runtime modification and avoiding additional processing time during execution.
3Measurement precision
If unmodified function name calls are trapped for analysis, then detection accuracy is improved, but system performance and execution speed decrease
Solution Approach 1:
The trapping mechanism is applied selectively only to calls of unmodified function names, which are extracted from the normal execution flow and subjected to analysis. By isolating only these specific calls for inspection rather than monitoring all function calls, the system maintains high detection accuracy for malicious code while minimizing the performance impact on legitimate program execution.
Data Source
Figure 1A
Figure 1B
Figure 2A~2C
AI summary
Embodiments include neutralizing and/or detecting attacks by malicious code, for example, by modifying (e.g., morphing) certain aspects of translation tables utilized by an interpreter. Translation table(s) may be morphed, for example, by modifying (e.g., randomizing) function names and/or bytecode instructions included therein. Programs and/or scripts to be executed by the interpreter are also patched to reference the modified function names and/or bytecode instructions, thereby enabling such programs and/or scripts to successfully call the modified function names (whereas malicious code continues to call the original function names). Calls to unmodified/unrecognized functions and/or bytecode instructions performed by the program or script may be trapped and logged for further analysis to check for malicious activity.