Lightweight Executor for Malware Detection via Fake Kernel
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current dynamic evaluation methods for malware detection are system-heavy and vulnerable to evasion techniques, requiring full system virtualization and failing to expose malicious behavior that occurs only in specific system environments.
Innovation Solution
The implementation of a lightweight executor that mimics a real operating system kernel to execute executable files, allowing for the observation of runtime behavior without full system virtualization, and using a fake kernel to respond to system calls, thereby reducing resource usage and detecting malware effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full system virtual machine is used for dynamic evaluation, then malware behavior can be observed in a complete system environment, but computing resources and system complexity increase significantly
Solution Approach 1:
The patent segments the virtual machine into a lightweight executor that runs only the executable file being evaluated, rather than a full system virtual machine. This segmentation isolates the evaluation process from the host system, reducing complexity while maintaining the ability to observe malware behavior through controlled system call interception and emulation.
Solution Approach 2:
The patent extracts only the essential components needed for malware evaluation from a full virtual machine environment. The lightweight executor extracts and emulates only the kernel interface and necessary system calls, removing unnecessary system components, thereby reducing resource consumption while preserving malware detection capability.
2Reliability
If a full system virtual machine is used for dynamic evaluation, then malware behavior can be observed in a complete system environment, but computing resources are consumed heavily
Solution Approach 1:
The virtual machine environment is segmented into a minimal lightweight executor that processes only the specific executable file under evaluation. This segmentation eliminates the need to allocate resources for unnecessary system services and processes, significantly reducing computing resource consumption while maintaining reliable malware detection through focused observation of the target executable's behavior.
Solution Approach 2:
The patent extracts and emulates only the essential kernel interface and system call handling capabilities needed for malware evaluation. By removing unnecessary system components and services from the virtualized environment, the lightweight executor consumes fewer computing resources while preserving the ability to detect malware behavior through systematic observation of executed instructions and system calls.
3Productivity
If a lightweight executor is used, then computing resources are reduced, but the ability to detect malware using evasion techniques may be compromised
Solution Approach 1:
The patent introduces a fake kernel as an intermediary layer between the executable file and the host system. This fake kernel emulates the behavior of a real operating system kernel, intercepting and responding to system calls in a manner that mimics legitimate system behavior. This intermediary enables the lightweight executor to maintain high evaluation efficiency while preserving the ability to detect malware evasion techniques, as the malware interacts with the fake kernel just as it would with a real kernel, exposing its malicious behavior.
Data Source
AI summary
Executable files are evaluated for malware in one or more lightweight executors, such as lightweight executor processes. An executable file is loaded and executed in a lightweight executor. Instructions in an execution path of the executable file are executed. Instructions in another execution path of the executable file are executed in another lightweight executor when a conditional branch instruction in an execution path has a suspicious condition. A fake kernel that mimics a real operating system kernel receives system calls, and responds to the system calls without servicing them in a way the real operating system kernel would. Runtime behavior of the executable file is observed for malware behavior. A response action, such as preventing the executable file from subsequently executing in a computer, is performed when the executable file is detected to be malware.