Malicious Code Detection via Document Data Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting malicious code embedded in digital documents is challenging due to its ability to be obfuscated and disguised as benign code, making it difficult for systems to distinguish between harmful and harmless code, especially in complex document formats like Microsoft Word and Adobe PDF.
Innovation Solution
The solution involves comparing documents to static and dynamic detection models, executing parts of the document to analyze behavior, and using arbitrary data transformation mechanisms to alter document segments and detect crashes or errors, thereby identifying and reporting malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional detection methods are used to scan for malicious code, then the system can identify known threats, but malicious code obfuscated as benign code can evade detection
Solution Approach 1:
The system performs preliminary actions by transforming data in the document before execution to a form that would cause malicious code to crash or fail, while benign code continues to function normally. This proactive transformation approach allows detection before the malicious code can execute its harmful payload.
Solution Approach 2:
The invention converts the harmful effect of malicious code (which relies on specific data patterns to execute) into a benefit by transforming the data so that the malicious code crashes or fails. The very specificity that allows malicious code to target vulnerabilities becomes its weakness when the data is transformed.
2Measurement precision
If the system executes the document to analyze behavior, then it can detect malicious code through dynamic analysis, but the malicious code may already have executed harmful actions before detection
Solution Approach 1:
The system applies data transformation before execution, creating a protected state where malicious code cannot successfully execute. This preliminary protective action ensures that even if dynamic analysis is performed, the malicious code is already neutralized and cannot cause harm during the analysis phase.
3Difficulty of detecting and measuring
If the system transforms data arbitrarily to detect malicious code, then it can identify hidden threats, but the transformation may alter benign code and cause false positives
Solution Approach 1:
The system uses feedback by monitoring whether code executes successfully or crashes after transformation. Benign code that is robust will continue to function normally despite data transformation, while malicious code designed to exploit specific data patterns will crash or fail. This feedback mechanism allows the system to distinguish between benign and malicious code based on their response to transformation.
Solution Approach 2:
The invention changes parameters of the data (such as byte values, data structures, or memory layouts) in a controlled manner. By altering these parameters and observing the code's response, the system can identify malicious code that relies on specific parameter values to execute, while benign code adapts gracefully to the parameter changes.
Data Source
AI summary
Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack. In some embodiments, the methods include: selecting a data segment in at least one portion of an electronic document; determining whether the arbitrarily selected data segment can be altered without causing the electronic document to result in an error when processed by a corresponding program; in response to determining that the arbitrarily selected data segment can be altered, arbitrarily altering the data segment in the at least one portion of the electronic document to produce an altered electronic document; and determining whether the corresponding program produces an error state when the altered electronic document is processed by the corresponding program.