Selective Malware Analysis Based on File Compression Type
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic analysis for identifying malicious software is a resource-intensive and time-consuming process, especially when malware is compressed using techniques like packing, protection, or archiving, making it difficult to detect effectively using static analysis.
Innovation Solution
A method that selectively applies dynamic or static malware analysis based on the compression type of a file, where files are identified as packed, protected, or archived before runtime, and decompressed using specific or general tools to determine the appropriate analysis type, with static analysis prioritized for efficiency and dynamic analysis used when decompression fails.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is applied to identify malicious samples, then detection accuracy is improved, but resource consumption and time requirements increase significantly
Solution Approach 1:
The analysis system segments malware detection into two distinct paths: static analysis for compressed files and dynamic analysis for non-compressed files. This segmentation allows the system to apply the more resource-intensive dynamic analysis only when necessary, while using faster static analysis for the majority of compressed files, thereby resolving the contradiction between detection accuracy and analysis efficiency
Solution Approach 2:
The system dynamically selects the analysis method based on file compression status. By making the analysis approach adaptive rather than fixed, the system can optimize resource usage in real-time based on the specific characteristics of each file, improving overall productivity while maintaining detection accuracy when needed
2Productivity
If static analysis is used to quickly identify malicious samples, then analysis speed is improved, but detection capability is reduced for compressed malware
Solution Approach 1:
The system performs preliminary identification of file compression status before selecting the analysis method. This preliminary action allows the system to prepare the appropriate analysis approach in advance, ensuring that static analysis is used for compressed files (where it is effective) and dynamic analysis is reserved for non-compressed files, thus maintaining both speed and detection capability
3Reliability
If dynamic analysis is applied to all compressed files, then detection thoroughness is improved, but resource consumption increases unnecessarily
Solution Approach 1:
The system applies different quality levels of analysis to different file types: compressed files receive static analysis (lower resource consumption) while non-compressed files receive dynamic analysis (higher resource consumption). This local differentiation of analysis quality ensures thoroughness where needed while conserving resources where sufficient analysis can be achieved more efficiently
Data Source
AI summary
A file is received from external to the gateway device and, prior to runtime, the received file is detected as being compressed. Also before runtime, a compression type of the received file is differentiated as packed, protected, and/or archived. Identification of a specific packer, a specific protector or a specific archiver corresponding to the compression type is attempted. Responsive to successful identification, the received file is decompressed and a static type of malware analysis is selected for the received file. Responsive to unsuccessful identification, decompress the received file is attempted with a general unpacker, a general unprotector or a general unarchiver, and responsive to successful decompression, the static type of malware analysis is selected for the received file. Responsive to unsuccessful decompression, a dynamic type of malware analysis on the received file is selected.