Malicious Program Detection via Control Flow Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious program detection methods, such as pattern matching and heuristic-based approaches, are prone to false positives and negatives, and can be evaded through code obfuscation and encryption, necessitating a more resilient detection method.
Innovation Solution
The method involves generating a control flow graph from program information, identifying sensitive functions, and performing a backward data flow trace to detect potentially malicious programs based on their code structure and data flow patterns, combining static and dynamic analysis for enhanced detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching or heuristic-based detection is used, then detection speed is maintained, but detection accuracy deteriorates due to false positives and negatives
Solution Approach 1:
The patent segments the malicious program into multiple basic blocks and represents their execution flow as a control flow graph with nodes and edges. This segmentation allows detailed analysis of individual code segments and their relationships, improving detection accuracy by examining the structural organization rather than relying on superficial pattern matching.
Solution Approach 2:
The patent transitions from traditional one-dimensional pattern matching to a multi-dimensional analysis by constructing control flow graphs that capture both the sequential execution order and hierarchical structure of code. This dimensional transformation enables detection of malicious patterns that span multiple code regions and execution paths.
2Reliability
If traditional detection methods are used, then ease of operation is maintained, but reliability deteriorates due to evasion through obfuscation and encryption
Solution Approach 1:
The patent performs preliminary construction of control flow graphs from the malicious program code before detection analysis. This preliminary action creates a structured representation that preserves the logical execution flow even when the code is obfuscated or encrypted, enabling reliable detection by analyzing the reconstructed control flow rather than the original obscured code.
Solution Approach 2:
The control flow graph serves as an intermediary representation between the raw malicious code and the detection engine. This intermediary structure abstracts away obfuscation techniques while preserving essential execution characteristics, allowing the detection system to analyze program behavior without being misled by code obfuscation or encryption.
3Reliability
If code execution for unpacking is used, then detection capability improves, but ease of operation deteriorates due to evasion through user parameters and encryption keys
Solution Approach 1:
The patent segments the malicious program into basic blocks and represents control flow as a graph structure, eliminating the need for full code execution. This segmentation allows static analysis of code structure and data flow without requiring the program to be unpacked or executed, thereby maintaining detection robustness while avoiding the operational complexity and security risks of dynamic execution.
Data Source
AI summary
Malicious programs may be detected by obtaining program information of a program. A control flow graph may be generated based on the program information. The program may be identified as being potentially malicious based on one or more portions of the control flow graph.