Iterative Microcode Emulation for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect malicious code, particularly branch-oriented programming (BOP) like jump-oriented programming (JOP) and return-oriented programming (ROP), which exploit software vulnerabilities by manipulating code execution without injection, making it difficult to identify suspicious behavior in computer networks.
Innovation Solution
The method involves iterative emulation of microcode by executing instruction streams from various offsets in a memory image, emulating different privilege rings and operating system calls, and using a sliding window to identify suspect behavior, including dynamic, parametric, and static checks for malicious code signatures, while limiting emulation to relevant offsets using hashing and Bloom filters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional code injection detection methods are used, then detection simplicity is maintained, but detection effectiveness against branch-oriented programming attacks is insufficient
Solution Approach 1:
The patent introduces an intermediary emulation environment that simulates the target system's execution context. This intermediary layer allows indirect observation of code behavior without directly executing suspicious code, enabling detection of branch-oriented programming attacks while maintaining system safety. The emulation environment acts as a mediator between the detector and the potentially malicious code.
Solution Approach 2:
The patent creates a copy of the execution environment through emulation, replicating the target system's architecture, registers, and memory state. By analyzing behavior in this copied environment rather than the real system, the detection method achieves higher precision in identifying malicious patterns without the complexity of direct interception or modification of actual code execution.
2Measurement precision
If code emulation is performed at every offset in memory image, then detection coverage is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary filtering of memory offsets using heuristics that identify promising starting points for emulation based on code characteristics, such as alignment patterns, instruction boundaries, and suspicious opcodes. This preliminary action reduces the search space before committing to full emulation, thereby maintaining detection coverage while reducing processing time.
Solution Approach 2:
The patent applies partial emulation by limiting the depth and scope of emulation at each offset, performing only enough execution to detect suspicious behavior patterns. Rather than fully emulating entire code segments, the method performs targeted partial emulation that achieves sufficient detection coverage without the time cost of complete execution analysis.
3Measurement precision
If privileged ring emulation is implemented, then detection accuracy for exploit behavior is improved, but system security risks increase
Solution Approach 1:
The patent uses the emulation environment as an intermediary that safely handles privileged ring operations. The emulated privileged code executes in an isolated virtual context where harmful effects cannot propagate to the host system. This intermediary approach maintains detection accuracy for privilege escalation exploits while eliminating security risks by containing all privileged operations within the emulation sandbox.
Solution Approach 2:
The patent creates a copied and isolated version of the privileged execution environment through emulation. By replicating the privileged ring context in the virtual machine rather than executing actual privileged code on the host, the system achieves accurate detection of exploit behavior while preventing any harmful effects from reaching the real system. The copy is sufficiently faithful for detection purposes but sufficiently isolated for safety.
Data Source
AI summary
Examples of systems, methods and media are shown for iteratively emulating potentially malicious code involving, for each offset of a microarchitecture for the code, emulating a first ring of an operating system, executing a segment of code in the emulated first ring, checking the behavior of the executing code for suspect behavior, and identifying the executing code as malicious code if suspect behavior is detected. Some examples include emulating a second ring of the operating system having a higher level of privilege than the first ring, such that the second ring emulation returns results to the executing code segment, but does not actually perform the functionality in a host platform.