Malicious File Detection via Behavioral API Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional methods for detecting malicious files, such as signature analysis and sandbox/emulation technologies, struggle to identify files whose behavior does not conform to known patterns, leading to poor detection quality.

Innovation Solution

A system and method that register API calls during file execution on a user computer, search for behavioral rules in a local database, and if no match is found, transmit the call log to a remote server for verification, updating the local database with received verdicts and signatures to enhance future detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional signature analysis and sandbox/emulation technologies are used to detect malicious files, then detection of known malicious patterns is improved, but detection quality of files with unknown or non-conforming behavior deteriorates

Engineering Contradiction:

Improvedetection qualityVSAvoidability to detect non-pattern-conforming files

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system dynamically adapts its detection approach by transitioning from static signature matching to dynamic behavioral analysis. The behavioral analyzer monitors API function calls in real-time during file execution, allowing the system to detect malicious files based on their actual runtime behavior rather than predefined patterns, thus improving detection of unknown malware variants

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system implements feedback mechanisms where detection results from behavioral analysis are used to update and refine the detection database. The behavioral analyzer collects information about API calls and system events, analyzes this data against known malicious patterns, and feeds back improved detection capabilities to the overall system, enhancing future detection accuracy for both known and unknown threats

Inventive Principle:

Principle #23Feedback

2Object-affected harmful factors

If files are executed in a sandbox environment with limited time span, then system safety is improved, but detection of shellcode execution deteriorates due to premature termination

Engineering Contradiction:

Improvesystem safetyVSAvoidshellcode detection accuracy

Core Design Contradiction:

Object-affected harmful factorsVSMeasurement precision

Solution Approach 1:

The system introduces an intermediary behavioral analyzer that operates between the sandbox environment and the file execution process. This analyzer uses interceptor drivers to monitor and record API function calls without directly interfering with the execution flow, allowing shellcode to execute fully while capturing evidence of malicious behavior for later analysis

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary setup of interceptor drivers and monitoring infrastructure before file execution begins. These components are pre-configured to track specific API calls and system events that indicate malicious behavior, ensuring that when shellcode executes even in a time-limited sandbox, the necessary data is already being collected for detection

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If behavioral analysis is performed on user computer instead of in isolated environment, then detection of environment-specific evasion techniques is improved, but risk of malicious file execution deteriorates

Engineering Contradiction:

Improvedetection of evasion techniquesVSAvoidrisk during execution

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The system segments the analysis process into two distinct phases: a safe preliminary phase where signature analysis and initial behavioral rules are applied without full execution, and a controlled monitoring phase where the behavioral analyzer activates interceptor drivers to track API calls. This segmentation allows detailed behavioral analysis on the user computer while maintaining safety through layered protection mechanisms

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11829473B2System and method for detecting malicious files by a user computer

Publication Date: 2023.11.28 AO KASPERSKY LAB

AI summary

Disclosed herein are methods and systems for detecting malicious files by a user computer. For example, in one aspect, the method comprises registering application programming interface (API) calls made by a file during an execution of the file on the user computer in a local call log, the local call log comprising control flow graphs of processes launched from the file, searching for a rule that matches behavioral rules a local database, when the behavioral rules are found, determining the file is malicious and halting execution of the file on the user computer, otherwise, transmitting the local call log to a remote server, receiving a verdict, when the verdict indicates the file is malicious, receiving a virus signature corresponding to the verdict, and updating the local call log based on the verdict and virus signature, wherein the updating enables detection of subsequently received malicious files.