Malicious System Detection via Time-Dependent State Analysis

Instead of analyzing the malicious program's code structure directly (which is obfuscated), the patent inverts the approach by analyzing what the program does not do or by examining the obfuscation techniques themselves as indicators. The system detects obfuscation patterns and uses them as features for classification, turning the evasion mechanism into a detection signal.

The patent transforms the detection parameters from code-level features (signatures, syntax) to behavioral and statistical features (execution patterns, API call sequences, control flow characteristics). By changing the parameter space from static code analysis to dynamic behavior analysis, the system can detect obfuscated malware that maintains its functional behavior despite code transformation.

The patent introduces an intermediary layer of analysis that does not directly emulate the malicious program's full behavior (which would be vulnerable to anti-emulation techniques). Instead, it uses intermediate representations such as control flow graphs, API call sequences, and statistical models that capture behavioral patterns without requiring complete program execution, thereby bypassing anti-emulation defenses.

Rather than performing complete emulation of the malicious program (which triggers anti-emulation mechanisms), the patent applies partial action by analyzing only critical subsets of behavior - key API calls, essential control flow paths, and signature behavioral patterns. This partial analysis suffices for detection while avoiding the detection thresholds that trigger anti-emulation responses.