Malware Behavior Analysis Using Synthetic Detonation Contexts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are time-consuming and resource-intensive due to the obfuscation and disguise of malicious software, making it difficult to determine whether a program is malware or exhibiting malicious behavior.
Innovation Solution
A system and method for detecting malware by monitoring system components, analyzing event streams, and identifying patterns of operations or process genealogies without disassembly, using security agents and cloud technology to automate detonation, analysis, and reporting, allowing for the detection of similar malware variants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used to analyze obfuscated malware, then detection accuracy is maintained, but analysis time and computational resources increase significantly
Solution Approach 1:
The patent replaces traditional mechanical disassembly and static analysis methods with automated dynamic execution and behavioral monitoring. Security agents execute malware in controlled environments and automatically capture system calls, registry changes, and file operations, substituting manual analysis with automated observation of actual malware behavior.
Solution Approach 2:
The patent introduces security agents as intermediaries between the malware and the analysis system. These agents monitor and record malware operations without directly interacting with the malware's obfuscated code, capturing behavioral patterns through system calls and event streams rather than analyzing the malware's internal structure directly.
2Measurement precision
If traditional malware detection methods are used to analyze obfuscated malware, then detection accuracy is maintained, but computational resources are consumed excessively
Solution Approach 1:
The patent replaces computationally intensive static analysis and disassembly operations with lighter-weight dynamic execution monitoring. Instead of attempting to decode and analyze obfuscated code structures, the system observes actual runtime behavior through security agents, significantly reducing CPU and memory requirements while maintaining detection effectiveness.
Solution Approach 2:
The patent creates copies of malware behavior through virtualized execution environments and event stream recordings. Rather than analyzing the original complex obfuscated malware directly, the system captures and analyzes copies of its operational behavior, reducing the computational burden of dealing with encrypted and obfuscated code structures.
3Reliability
If security agents monitor and record all malware operations, then detection coverage is improved, but data processing complexity increases
Solution Approach 1:
The patent extracts only the essential behavioral indicators from comprehensive security event data. Security agents capture detailed system calls, registry modifications, and file operations, but the analysis system focuses on extracting specific patterns such as suspicious process creations, unusual network connections, and characteristic malware behaviors, filtering out redundant information.
Solution Approach 2:
The patent segments malware analysis into distinct operational phases and behavior categories. Security agents monitor different aspects of malware execution separately (process creation, file system changes, network activity, registry modifications), allowing the system to process and analyze each segment independently rather than dealing with monolithic complex data streams.
Data Source
AI summary
A security service can determine a synthetic context based at least in part on context data associated with a first malware sample, and detonate the first malware sample in the synthetic context to provide one or more first event records representing events performed by the first malware sample and detected during detonation. Additionally or alternatively, the security service can detonate the first malware sample and locate a second malware sample in a corpus based at least in part on the one or more first event records. Additionally or alternatively, the security service can receive event records representing events detected during a detonation of a first malware sample, the detonation based at least in part on context data, and locate a second malware sample in the corpus based at least in part on the one or more reference event records.