Malicious Process Detection via Execution Stack Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques are ineffective in identifying modified or obfuscated malware, particularly in zero-day attacks, and fail to detect malicious code injections into trusted processes, as they rely on static analysis, digital signatures, and are vulnerable to anti-emulation tricks.
Innovation Solution
A driver and machine learning engine that constantly monitors process threads at specific control points, analyzing call stack traces to generate probabilistic estimates of danger, allowing for remedial actions such as restoring modified files and terminating malicious processes, and updating heuristics databases for improved detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis techniques are used to detect malware, then known virus patterns can be identified, but modified or obfuscated malware and zero-day attacks cannot be detected
Solution Approach 1:
The patent replaces static mechanical analysis (pattern matching against known signatures) with dynamic behavioral analysis using machine learning models that observe process execution patterns, system calls, and runtime behavior to detect malware regardless of its obfuscation or modification status
Solution Approach 2:
The system performs preliminary monitoring and analysis of process behavior before actual damage occurs, capturing execution traces and system call sequences in advance to train ML models that can subsequently identify malicious patterns even in previously unknown malware variants
2Reliability
If dynamic analysis techniques are used to execute suspicious code in virtual machines, then active malware can be observed, but anti-emulation tricks cause the emulator to fail
Solution Approach 1:
The patent introduces an intermediary layer of behavioral monitoring that observes malware operations without directly executing them in a virtualized environment. The system captures system calls, process transitions, and execution patterns as intermediaries to analyze malicious behavior while avoiding direct engagement with anti-emulation mechanisms
Solution Approach 2:
The system substitutes direct dynamic execution analysis with static behavioral pattern capture and machine learning classification, replacing the mechanical process of running code in VMs with an observational approach that analyzes execution traces and system interaction patterns
3Reliability
If digital signatures are used to identify trusted processes, then known safe processes can be recognized, but injected malicious processes within trusted processes cannot be detected
Solution Approach 1:
The patent segments the analysis from the process level to the thread and execution trace level, enabling independent monitoring of individual threads within trusted processes. This segmentation allows detection of malicious injections without requiring the parent process to be untrusted, as each thread's execution pattern is independently analyzed
Solution Approach 2:
The system performs preliminary monitoring of thread execution patterns and system calls before malicious code executes harmful operations. By capturing execution traces and behavioral patterns in advance, the system can identify injected malicious threads based on their anomalous behavior patterns rather than relying on digital signatures
Data Source
AI summary
Disclosed are systems and methods for detecting malicious applications. An exemplary method may comprise detecting that a first process has been launched on a computing device. The method may comprise receiving, from the first process, an execution stack associated with one or more control points of the first process. The method may comprise applying a machine learning classifier on the execution stack, wherein the machine learning classifier is configured to classify whether a process is malicious based on activity on control points captured on a given execution stack, and wherein a feature of a malicious process is detection of a system call to create a remote thread that runs in a virtual address space of a shared-service process configured to import third-party processes to be embedded as separate threads. The method may comprise generating an indication that the execution of the first process is malicious/non-malicious.