Malicious Code Detection via Functional Normalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious programs, such as viruses, are ineffective against obfuscated code that changes signatures through techniques like code transposition, dead code insertion, and metamorphic changes, which evade both signature and heuristic detection systems.
Innovation Solution
A computer program that converts program instructions into a standardized form based on their function, allowing for detection of malicious code signatures regardless of their expression, using a preprocessor to create a logically equivalent version and a detector to identify malicious code portions by reviewing this standardized version against a library of patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature detection is used to identify malicious code, then detection accuracy is improved for known viruses, but detection effectiveness deteriorates when viruses use code obfuscation techniques
Solution Approach 1:
The patent transforms the detection parameter from static code signatures to dynamic execution behavior characteristics. By monitoring how the program executes (system calls, API calls, control flow patterns) rather than what the code looks like statically, the system maintains detection accuracy against obfuscated malware that preserves its functional behavior despite signature changes.
Solution Approach 2:
The patent introduces a sandbox environment as an intermediary between the suspect program and the host system. This sandbox captures execution behavior and system interactions, allowing detection of malicious patterns without direct exposure to the host. The sandbox acts as a mediator that translates complex obfuscated code into observable behavioral signatures.
2Adaptability or versatility
If code obfuscation techniques are applied to evade detection, then the virus signature changes, but the essential function of the code remains unchanged
Solution Approach 1:
Instead of detecting malware based on its code appearance (which obfuscation changes), the patent inverts the approach by detecting based on functional behavior (which remains constant). The detection system looks at what the code does rather than what it looks like, turning the obfuscation problem on its head by making signature variability irrelevant to detection.
Solution Approach 2:
The patent changes the detection parameter from static code characteristics to dynamic execution characteristics. By monitoring execution behavior, system calls, and runtime patterns, the system detects malware based on its functional parameters rather than its code representation, thereby ignoring obfuscation-induced signature changes.
3Reliability
If frequent scanning of in-memory program image is performed to detect encrypted viruses, then detection capability is improved, but system performance deteriorates
Solution Approach 1:
The patent performs preliminary analysis by setting up instrumentation and breakpoints before the malicious code executes its harmful payload. By capturing execution behavior early in the sandbox environment, the system detects threats before they can cause damage, avoiding the need for continuous frequent scanning during execution.
Solution Approach 2:
The patent allows the suspect program to execute rapidly in the sandbox environment without interruption, capturing its behavior in real-time. This single-pass execution approach is more efficient than frequent scanning, as it observes the complete execution flow in one continuous run rather than repeatedly pausing and scanning the in-memory image.
Data Source
AI summary
A technique for finding malicious code such as viruses in an executable binary file converts the executable binary to a function unique form to which function unique forms of virus code may be compared. By avoiding direct comparison of the expression of the viral code but looking instead at its function, obfuscation techniques intended to hide the virus code are substantially reduced in effectiveness.