Malware Analysis Prioritization via Preliminary Static Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques face challenges in effectively selecting malware for analysis, particularly when discrepancies in communication counterparts based on program code similarity are overlooked, and new or obfuscated malware types are difficult to identify, leading to potential missed malicious communications.
Innovation Solution
A malware analysis system comprising a preliminary analysis unit that executes candidate malware to gather communication information, a determination unit that assesses suitability for analysis based on this information, and a designation unit that prioritizes analysis order for selected malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is performed on all collected malware samples to create a comprehensive blacklist, then the effectiveness of malware detection measures is improved, but the calculation resources required become excessively large and analysis redundancy increases
Solution Approach 1:
The patent performs static analysis as a preliminary step before dynamic analysis to extract communication counterpart information and calculate similarity metrics. This preliminary action identifies high-priority samples that require full dynamic analysis, avoiding redundant analysis of similar malware and reducing overall computational resources while maintaining detection effectiveness
Solution Approach 2:
Instead of performing complete dynamic analysis on all samples, the patent applies partial analysis (static analysis) to all samples and only performs excessive action (full dynamic analysis) on selected high-priority samples. This selective approach balances resource consumption with the need to maintain an effective blacklist
2Productivity
If static analysis based on program code similarity is used to select malware samples, then analysis redundancy is reduced, but discrepancies in communication counterparts are overlooked and new or obfuscated malware types are missed
Solution Approach 1:
The patent uses static analysis as a preliminary filtering step to identify and eliminate obviously similar samples, reducing the candidate pool. Then dynamic analysis is performed on the remaining samples to detect communication behaviors that static analysis might miss, including new or obfuscated malware types
Solution Approach 2:
The patent introduces communication counterpart information as an intermediary criterion between static and dynamic analysis. Samples are first filtered by code similarity, then further evaluated based on their communication behaviors, creating a multi-stage selection process that balances efficiency and accuracy
3Productivity
If limited calculation resources are allocated to analyze newly found malware, then resource consumption is controlled, but the ability to analyze all potentially malicious samples is reduced
Solution Approach 1:
The patent performs preliminary static analysis on all newly found malware samples to extract key features including communication counterpart information and code similarity metrics. This preliminary action creates a prioritized queue that guides subsequent dynamic analysis resource allocation
Solution Approach 2:
The patent changes the analysis parameters from binary (analyze/don't analyze) to a prioritized spectrum. By calculating similarity scores and communication risk metrics, the system transforms the selection criterion into a ranked list, allowing resources to be allocated to the most suspicious samples first
Data Source
AI summary
A malware analysis system includes a preliminary analysis unit, a determination unit, and a designation unit. The preliminary analysis unit executes malware obtained as a candidate for an analyzing subject to obtain information related to communication transmitted from the malware. The determination unit determines whether the malware is handled as an analyzing subject based on information obtained by the preliminary analysis unit. The designation unit designates an analyzing order with respect to malware having been determined by the determination unit as an analyzing subject based on information obtained by the preliminary analysis unit.