Malicious Code Evolutionary Analysis via Graph Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for analyzing malicious codes are inefficient due to the exponential increase in new malicious codes, with dynamic analysis being resource-intensive and inaccurate, and existing algorithms struggling to infer evolutionary relationships, especially when creation time information is lacking or when binary codes are packed or anti-debugged.
Innovation Solution
The method involves generating representative graphs by analyzing source code to identify dependency relationships, clustering based on similarity, and inferring evolutionary orders using a combination of dynamic and static analysis, with specific weight values and algorithms like K-means clustering and Needleman-Wunsch, to accurately classify and analyze malicious code functions and their evolutionary relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is used to extract data-dependency graphs from malicious codes, then comprehensive coverage of execution range is achieved, but resource consumption and analysis time increase significantly
Solution Approach 1:
The patent segments the analysis process into two distinct phases: static analysis to extract initial data-dependency graphs and identify potential malicious functions, followed by selective dynamic analysis only for suspicious code segments. This segmentation allows comprehensive coverage of the codebase through static analysis while limiting resource-intensive dynamic analysis to only necessary portions, thereby reducing overall analysis time and resource consumption.
Solution Approach 2:
The patent performs preliminary static analysis to generate data-dependency graphs and identify suspicious patterns before executing dynamic analysis. By pre-processing the malicious code to extract control flow graphs, call graphs, and data flow information, the system prepares the code structure in advance, allowing dynamic analysis to focus only on identified suspicious regions rather than analyzing the entire codebase dynamically, thus reducing analysis time.
2Extent of automation
If algorithms infer evolutionary relationships based on program size and complexity, then automated analysis is achieved, but accuracy decreases for release-built binaries and root binaries
Solution Approach 1:
The patent changes the parameters used for evolutionary relationship inference from simple program size and complexity metrics to multi-dimensional features including control flow graph structures, call graph patterns, data dependency relationships, and semantic information from API calls. This parameter transformation enables accurate differentiation between release-built binaries (which may be compressed) and root binaries, maintaining high automation while improving measurement precision through more discriminative features.
Solution Approach 2:
The patent combines multiple analysis techniques and feature types into a composite approach: integrating static analysis features (control flow, data flow, syntax trees) with dynamic analysis features (API call sequences, runtime behavior) to create a comprehensive feature set for evolutionary relationship inference. This composite methodology overcomes the limitations of single-approach algorithms, achieving both automation and accuracy by leveraging the strengths of multiple analysis paradigms.
3Reliability
If unpacking processes are used to analyze packed malicious codes, then evolutionary relationship analysis becomes possible, but binary code changes and inference accuracy decreases
Solution Approach 1:
The patent introduces an intermediary layer of abstract representation between the packed binary and the analysis process. Instead of directly unpacking and analyzing modified binaries, the system uses intermediate representations such as control flow graphs, data-dependency graphs, and syntax-aware feature extractions that capture the essential evolutionary characteristics without requiring binary modification. This intermediary approach preserves the original binary integrity while enabling accurate evolutionary relationship analysis.
Solution Approach 2:
The patent creates copies of the malicious code in the form of abstract syntax trees, control flow graphs, and data dependency models rather than working directly with the packed binary. These copied representations capture the structural and functional essence of the malware for evolutionary analysis without requiring unpacking that would alter the original binary. By analyzing these copied abstract representations, the system maintains both the ability to analyze packed codes and the accuracy of evolutionary relationship inference.
4Measurement precision
If analysts manually analyze each newly discovered malicious code, then detailed analysis is achieved, but productivity decreases due to the large volume of codes
Solution Approach 1:
The patent implements self-service through automated analysis systems that perform initial classification, feature extraction, and evolutionary relationship inference without human intervention. The system automatically generates data-dependency graphs, identifies malicious functions, and categorizes new malware based on learned patterns from previous analyses. This automation handles the bulk of routine analysis tasks, freeing analysts to focus only on complex cases that require human expertise, thereby maintaining detailed analysis quality while dramatically increasing overall productivity.
Solution Approach 2:
The patent incorporates feedback mechanisms where the results of automated analysis feed into refined models and updated knowledge bases. The system continuously learns from analyzed malware samples, improving its classification accuracy and evolutionary relationship inference capabilities over time. This feedback loop enables the automated system to maintain high analysis quality comparable to manual expert analysis while processing large volumes of malware, as the system becomes increasingly proficient through accumulated experience.
Data Source
AI summary
Provided are a method and an apparatus for analyzing a malicious code by accurately and rapidly analyzing source code extracted from a set of a plurality of malicious codes, calculating a first degree of complexity of each of a plurality of malicious code binaries, select a root binary initially generated, by using the calculated first degree of complexity, and inferring an evolutionary order of the plurality of malicious code binaries, except for the root binary, based on the calculated first degree of complexity and a degree of distance between the plurality of malicious code binaries.