Malicious Code Detection via API Call Time Intervals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious code detection methods based on dynamic analysis often misidentify normal code as malicious due to similar function names or patterns, and fail to detect variants of malicious code that change function names or patterns, leading to incorrect classifications and undetected threats.
Innovation Solution
A machine learning-based approach that analyzes API function call times by calculating time intervals and determining feature values from these intervals to train a malicious code detection model, which can identify and detect malicious code patterns without significant changes to existing detection models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis based on API call information is used for malicious code detection, then detection capability is provided, but normal code with similar function names or patterns is wrongly identified as malicious
Solution Approach 1:
The patent changes the detection parameters from static API function names to dynamic temporal features including time intervals between API calls, call frequencies, and sequential patterns. This transformation allows the system to distinguish malicious code from normal code even when they use similar function names, by analyzing the temporal characteristics of API invocation patterns.
Solution Approach 2:
The patent introduces dynamic analysis of API call timing patterns, where the system continuously monitors and analyzes the temporal dynamics of function calls. By examining when functions are called rather than just what functions are called, the system adapts to detect malicious behavior patterns while avoiding false positives from legitimate applications with similar function sets.
2Adaptability or versatility
If existing dynamic analysis methods are used, then some malicious code can be detected, but variants that change function names or patterns are not detected
Solution Approach 1:
The patent segments the API call sequence into multiple temporal windows and analyzes each segment independently for specific temporal features. This segmentation approach allows the system to capture different phases of malicious behavior and detect variants by identifying consistent temporal patterns across segments, even when function names or specific patterns change.
Solution Approach 2:
The patent adds temporal dimension to the traditional API call analysis by incorporating time intervals, call frequencies, and sequential timing patterns. This dimensional transformation enables the detection system to identify malicious code variants through their temporal execution characteristics, providing broader detection coverage without sacrificing accuracy.
3Measurement precision
If machine learning model is trained with API call sequences and temporal features, then detection accuracy improves to 93%, but computational complexity increases
Solution Approach 1:
The patent extracts specific critical temporal features from the complete API call sequences, focusing on key parameters such as time intervals between calls, call frequencies, and dominant sequential patterns. This feature extraction approach reduces the dimensionality of the input data for the machine learning model, improving detection accuracy while reducing computational complexity compared to analyzing entire raw call sequences.
Data Source
AI summary
A method of training a malicious code detection model and a method of detecting a malicious code. The method includes acquiring application programming interface (API) call information of called functions from a result log of performing dynamic analysis of a malicious code, calculating time intervals between timestamps using the timestamps which indicate API call times extracted from the API call information, determining a feature value of the malicious code on the basis of the time intervals, and training the malicious code detection model using an API call sequence included in the API call information and the feature value.