Malware Analysis Procedure Recommendation System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware analysis techniques are inefficient due to varying analysis procedures based on conditions such as analysis purpose, malware family, version, and environment, making it difficult to perform malware analysis effectively.
Innovation Solution
A malware analysis support system that includes an analyst computer and an analysis computer, where the analyst computer inputs analysis conditions and purpose information, and the analysis computer calculates and recommends a tailored analysis procedure based on past and current procedures, reducing user burden and improving efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If analysis procedures are customized according to various analysis conditions (purpose, malware family, version, environment), then analysis precision and effectiveness are improved, but device complexity and operational difficulty increase
Solution Approach 1:
The patent implements dynamic analysis procedures that automatically adapt to different analysis conditions (purpose, malware family, version, environment). The system selects and customizes analysis steps based on input parameters, transforming static fixed procedures into dynamic conditional workflows. This resolves the contradiction by providing high precision through customization while managing complexity through automated condition-based selection rather than manual configuration.
Solution Approach 2:
The system changes procedural parameters based on analysis conditions. Different analysis purposes, malware families, versions, and environments trigger different procedure configurations. This parameter-driven approach allows the system to maintain high analysis precision for each specific condition while avoiding the complexity of manually designing separate procedures for each scenario.
2Reliability
If analysis procedures are customized according to various analysis conditions, then analysis effectiveness is improved, but ease of operation deteriorates
Solution Approach 1:
The system performs self-service by automatically selecting and configuring appropriate analysis procedures based on the analysis conditions provided by the user. Instead of requiring users to manually configure complex procedures, the system autonomously adapts the analysis workflow to match the specific purpose, malware family, version, and environment, thereby maintaining high effectiveness while significantly improving ease of operation.
Solution Approach 2:
The system prepares multiple pre-configured analysis procedure templates in advance for different analysis conditions. When a user initiates an analysis, the system selects the appropriate pre-prepared template and applies it, eliminating the need for users to manually configure procedures while ensuring analysis effectiveness is maintained through condition-matched templates.
3Productivity
If analysis procedures vary according to analysis conditions, then analysis productivity is improved through targeted approaches, but loss of time increases due to procedure selection and adaptation
Solution Approach 1:
The system performs preliminary preparation by creating and storing multiple analysis procedure templates in advance for different analysis conditions (purposes, malware families, versions, environments). When analysis is needed, the system quickly selects and applies the appropriate pre-prepared template, eliminating time-consuming manual configuration while maintaining high productivity through condition-specific optimization.
Solution Approach 2:
The system uses copying by replicating proven analysis procedure templates for different malware families and scenarios. Instead of creating procedures from scratch each time, the system copies and adapts existing templates to match current analysis conditions, significantly reducing setup time while maintaining productivity through reusable, condition-matched procedures.
Data Source
AI summary
In a malware analysis support system and a malware analysis support method of supporting a malware analysis, the analyst computer includes an analysis input unit configured to input analysis conditions of the malware analysis, an analysis purpose input unit configured to input analysis purpose information that is information corresponding to a malware analysis purpose included in the analysis conditions and collected through the malware analysis, and an analysis procedure suggestion unit configured to display an analysis procedure of the malware analysis, the analysis computer includes a recommended analysis procedure creation unit configured to execute a process for calculating the analysis procedure to be recommended to the user on a basis of the analysis conditions, the analysis purpose information, a past analysis procedure, and a current analysis procedure, and the analysis procedure suggestion unit recommends, to the user, the analysis procedure calculated by the recommended analysis procedure creation unit.