Malicious Code Detection via Memory Dump Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional signature analysis methods fail to effectively detect malicious files, especially polymorphic viruses, altered versions, and shellcodes, due to limitations in sandbox execution and API function call analysis.
Innovation Solution
A system and method that intercepts API calls during file execution, determines exit conditions, and transfers memory dumps to an emulator for further analysis, identifying malicious code by detecting specific signatures in the execution results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional signature analysis is used to detect malicious files, then the detection process is simple and fast, but it fails to detect polymorphic viruses, altered versions, and shellcodes
Solution Approach 1:
The patent introduces a sandbox environment as an intermediary between the malicious file and the analysis system. The file executes in the sandbox while API calls are intercepted and logged, allowing indirect observation of malicious behavior without direct exposure. This mediator enables detection of sophisticated threats like shellcodes that evade traditional signature analysis.
Solution Approach 2:
The patent replaces traditional mechanical signature-matching approaches with a behavioral analysis system using virtualization and API interception. Instead of comparing file signatures, the system substitutes execution-based observation, logging API calls, and analyzing process behavior to detect malicious code, thereby achieving higher detection accuracy for polymorphic and obfuscated threats.
2Measurement precision
If the file is executed in a sandbox with API function call interception, then the detection capability is improved, but the execution speed is substantially slowed down
Solution Approach 1:
The patent implements partial interception by selectively monitoring only specific API calls that are relevant to malicious behavior detection, rather than intercepting all API functions. The system focuses on capturing essential behavioral indicators while allowing non-critical operations to proceed without interception overhead, thereby maintaining detection accuracy while improving execution speed.
3Productivity
If the sandbox execution time is limited to several dozen seconds, then the productivity is maintained, but shellcodes may not be detected because the process terminates before control transfers to shellcode memory section
Solution Approach 1:
The patent performs preliminary actions by saving memory dumps at strategic points during sandbox execution, particularly before the process terminates. The system proactively captures memory state information including potential shellcode sections even when execution is interrupted, ensuring that subsequent analysis can detect shellcodes that would otherwise remain undetected due to premature process termination.
Data Source
AI summary
Disclosed are system and method for detecting malicious code in files. One exemplary method comprises: intercepting, by a processor, one or more application program interface (API) calls during an execution of a process launched from a file of a computing device; determining and detecting, by the processor, a presence of an exit condition of the process; in response to detecting the exit condition, identifying one or more signatures of a first type and transferring one or more saved memory dumps of the computing device to an emulator for execution; and determining and identifying a malicious code in the file in response to detecting one or more signatures of a second type based at least upon execution results of the transferred memory dumps of the computing device.