Iterative Malware Detection via Static-Dynamic Hybrid Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, particularly Pre-Execution static analysis, struggle with encrypted or packed malware samples, and dynamic analysis techniques like emulation and sandboxing are resource-intensive and not 100% accurate, leading to inefficiencies in detection.
Innovation Solution
Combining static and dynamic analysis techniques, where static analysis estimates file entropy to flag suspicious files, and dynamic methods reveal execution behavior, with machine-learning models re-estimating verdicts using system-level interceptors and user-mode hooks to improve detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If Pre-Execution static analysis is used to analyze encrypted or packed malware samples, then analysis speed is improved, but detection accuracy deteriorates due to lack of resolution
Solution Approach 1:
The system performs preliminary static analysis on encrypted/packed files to calculate entropy and identify suspicious characteristics before execution. This preliminary action flags files for iterative dynamic analysis, allowing fast initial filtering while preparing for more detailed examination.
Solution Approach 2:
The system transitions from static to dynamic analysis iteratively. As the malware executes and decrypts code in memory, the analysis dynamically adapts by capturing memory dumps at different execution stages, allowing the detection accuracy to improve progressively while maintaining analysis efficiency.
2Measurement precision
If dynamic analysis methods like emulation and sandboxing are used to reveal true nature of malicious files, then detection accuracy is improved, but resource consumption and analysis time increase
Solution Approach 1:
Instead of performing complete dynamic analysis on all files, the system applies partial dynamic analysis only to files flagged by static analysis as suspicious. The iterative approach performs dynamic analysis at multiple stages but only on selected samples, reducing overall resource consumption while maintaining high detection accuracy for problematic files.
Solution Approach 2:
The analysis process is segmented into multiple iterative stages. Each stage performs static analysis followed by selective dynamic analysis, with results fed back to improve subsequent static analysis. This segmentation allows the system to distribute resource consumption across multiple lighter analysis passes rather than requiring one heavy complete dynamic analysis.
3Measurement precision
If traditional dynamic behavior analysis tools like emulators are used, then deep analysis capability is improved, but false negatives increase due to malware detection of emulation environment
Solution Approach 1:
The system uses memory dumping and analysis as an intermediary technique. Instead of directly emulating the malware in a detectable environment, the system captures memory contents at various execution stages and analyzes them offline. This intermediary approach allows deep analysis without the malware detecting the emulation environment, as the analysis occurs on captured data rather than live execution.
Solution Approach 2:
The system creates copies of the malware execution state through memory dumps at different iteration stages. These copies are then analyzed statically without continuing the live execution. This copying technique allows deep analysis of the malware's decrypted code while avoiding the reliability issues of malware detecting and stopping execution in emulator environments.
4Measurement precision
If system behavior analyzers are used to control execution and trace operations, then detection capability is improved, but system performance degradation increases
Solution Approach 1:
The system applies behavior tracing partially, only to files that pass initial static analysis filters. By using entropy calculation and other static indicators to pre-filter samples, the system reduces the number of files requiring heavy behavior analysis, thereby maintaining detection capability while minimizing overall system performance impact.
Solution Approach 2:
The system performs preliminary static analysis including entropy calculation, header analysis, and signature matching before initiating behavior tracing. This preliminary action identifies and filters out obviously malicious or benign files, ensuring that resource-intensive behavior analysis is applied only to suspicious files, thus preserving system performance while maintaining detection capability.
Data Source
AI summary
A system and method of anti-malware analysis including iterative techniques that combine static and dynamic analysis of untrusted programs or files. These techniques are used to identify malicious files by iteratively collecting new data for static analysis through dynamic run-time analysis.