Malware Analysis Continuation Using Stored Attacker Responses

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing malware analysis methods face challenges in continuing dynamic analysis when the attacker server is not operational, necessitating separate static analysis and requiring the C2 server to be alive, which is time-consuming and skill-dependent.

Innovation Solution

A malware analysis continuation system that observes and accumulates communication with attacker servers, mediates communication using past data, and extracts similar communication to continue dynamic analysis even when the attacker server is down.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If dynamic analysis is performed by actually running malware, then analysis efficiency is improved, but analysis cannot continue when the attacker server is not operational

Engineering Contradiction:

Improveanalysis efficiencyVSAvoidanalysis continuity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system performs preliminary actions by observing and accumulating communication data with attacker servers before the server becomes unavailable. This stored communication data is then used to continue dynamic analysis even when the original server is down, resolving the contradiction between maintaining analysis efficiency and ensuring analysis continuity.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If static analysis is performed to create expected communication, then analysis can proceed without server operation, but advanced skills and time are required

Engineering Contradiction:

Improveanalysis continuityVSAvoidanalysis time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

Instead of performing time-consuming static analysis to create expected communication, the system copies actual communication data that was previously observed and accumulated from real interactions with attacker servers. This copied communication data can be directly used to continue dynamic analysis without requiring expert skills or additional time.

Inventive Principle:

Principle #26Copying

3Reliability

If communication with attacker server is suspended for static analysis, then server availability is not required, but execution path detection becomes random

Engineering Contradiction:

Improveanalysis continuityVSAvoidexecution path detection accuracy

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system uses feedback from previously accumulated communication data to guide the continuation of dynamic analysis. By referencing actual responses that were received from the attacker server during normal operation, the system can accurately determine the correct execution path without relying on random detection methods.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20250291919A1Malware analysis continuation system and malware analysis continuation method

Publication Date: 2025.09.18 HITACHI LTD

AI summary

Communication of dynamically analyzed malware is mediated. Even in a case where communication with the attacker server is stopped, a response accumulated as past data is returned to continue dynamic analysis.