Malicious Behavior Detection via Aggregated Sandbox Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods are ineffective against new and polymorphic malware, often resulting in delayed detection and propagation, and struggle to balance false positives and negatives, especially when dealing with zero-day threats and polymorphic variants that mutate to evade fingerprint matching.
Innovation Solution
A malicious behavior detection system that analyzes generic behaviors of executed objects in a controlled environment, using a combination of static and dynamic analysis to assign weights to behavior detectors' outputs, aggregating them into a maliciousness score to determine the likelihood of malware presence, and triggering alerts or generating fingerprints for future detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional fingerprint matching is used for malware detection, then known malware can be detected, but new and polymorphic malware cannot be detected
Solution Approach 1:
The patent transforms malware detection from static fingerprint matching to dynamic behavior analysis by changing the detection parameters from code signatures to execution behaviors. The system monitors multiple behavioral parameters (file system changes, registry modifications, network activity, process creation) during sandboxed execution, enabling detection of previously unseen malware variants based on their behavioral patterns rather than code structure.
Solution Approach 2:
The patent introduces dynamic analysis by executing malware samples in a sandboxed environment and monitoring their runtime behaviors. Instead of static code analysis, the system dynamically observes actual execution patterns, making the detection adaptable to polymorphic variants that change their code structure but maintain similar behavioral characteristics.
2Reliability
If antivirus scanning is performed after malware infection, then malware can be detected, but damage has already occurred and propagation may have spread
Solution Approach 1:
The patent implements preliminary detection by analyzing malware behaviors in a sandboxed environment before the malware can cause harm on the production system. The sandboxed execution allows the system to observe malicious behaviors and generate detection signatures in advance, enabling proactive blocking of malware before it infects user systems or propagates across the network.
3Adaptability or versatility
If polymorphic malware mutates to evade detection, then it can avoid fingerprint matching, but its malicious capabilities remain intact
Solution Approach 1:
The patent extracts the essential detection target from malware code by separating behavioral patterns from code structure. Instead of detecting specific code signatures that polymorphic malware changes, the system extracts and monitors invariant behavioral characteristics (such as attempting to delete security software, modifying system registry keys, or establishing persistent network connections) that remain consistent across polymorphic variants.
4Adaptability or versatility
If behavior analysis is used to detect malware, then new malware can be detected, but false positives may increase
Solution Approach 1:
The patent combines multiple behavioral indicators and analysis methods to improve detection precision. The system aggregates results from static analysis, dynamic sandboxed execution, heuristic evaluation, and pattern recognition algorithms, using ensemble decision-making to reduce false positives while maintaining high detection rates for new malware variants.
Data Source
AI summary
Techniques for detecting malicious behavior of content (object) are described herein. An object is processed within a virtual machine. Responsive to receiving the result of the processing (response object), a parser parses the response object into a plurality of sub-objects. The plurality of sub-objects include a first sub-object and a second sub-object. A first behavior match result is determined based, at least in part, on whether information within the first sub-object corresponds to a identifiers associated with malicious activity. Also, a second behavior match result is determined based, at least in part, on whether information within the second sub-object corresponds to identifiers associated with malicious activity. Thereafter, the first and second behavior match results are aggregated to produce an aggregated result, wherein a malicious behavior score is calculated based, at least in part, on the aggregated result. The object is classified according to the malicious behavior score.