Malware Detection via Call Graph Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware analysis in sandboxes is hindered by armoring techniques used by malware, which prevent the detection of API traces, leading to poorer malware detection rates due to reduced API call identification.
Innovation Solution
A security platform that performs both dynamic and static malware analyses, using a call graph to identify exits or forced kills of a software program, and combines results to detect malicious API traces that would have been logged without armoring, thereby improving malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic malware analysis is performed in a sandbox, then API traces can be logged to identify malicious behavior, but malware armoring techniques prevent the software program from executing fully, causing exits or forced kills that stop API trace logging
Solution Approach 1:
The system performs preliminary actions by creating a call graph before the software program exits or is forced to kill. The call graph is generated from partial execution data and predicts the complete control flow, allowing the system to reconstruct API traces that would have occurred had the program executed fully, thus maintaining measurement precision despite execution incompleteness
Solution Approach 2:
The call graph acts as an intermediary between the incomplete dynamic execution and the desired complete API trace information. By using the call graph as a mediator, the system can infer missing API traces from the structural relationships in the call graph, bridging the gap between partial execution data and comprehensive malware analysis
2Measurement precision
If malware uses armoring to detect sandbox execution and exit, then dynamic analysis cannot capture full API traces, but static analysis alone cannot identify actual runtime behavior
Solution Approach 1:
The system merges dynamic malware analysis (which captures actual runtime behavior and API calls) with static malware analysis (which examines code structure without execution). By combining both approaches, the system overcomes the limitations of each individual method: dynamic analysis provides real behavior data while static analysis provides complete code structure, together achieving high malware detection accuracy
Solution Approach 2:
The analysis system is segmented into distinct components: a dynamic analysis component that executes the software program and captures API traces, a call graph generation component that models control flow, and a static analysis component that examines code structure. This segmentation allows each component to specialize in specific tasks while working together to solve the overall malware detection problem
3Loss of information
If the software program exits or is forced to kill during dynamic analysis, then API trace logging stops prematurely, but continuing execution may trigger harmful malicious actions
Solution Approach 1:
Instead of continuing to execute the potentially harmful malware, the system creates a copy or model of the expected API traces using the call graph. The call graph is constructed from the partially executed program and used to simulate or predict the complete sequence of API calls that would have occurred, providing information completeness without executing harmful code
Solution Approach 2:
The system converts the harmful exit or forced kill behavior into a benefit by using it as a signal to trigger static analysis and call graph generation. The premature termination, which would normally lose API trace information, instead prompts the system to use alternative methods (call graph analysis, static analysis) to recover the complete API trace information without further executing malicious code
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A device receives a software program, performs a dynamic malware analysis of the software program to generate dynamic malware analysis results, and generates a call graph based on the dynamic malware analysis of the software program. The device utilizes, during the dynamic malware analysis of the software program, the call graph to identify an exit of the software program and/or a forced kill of the software program, and performs a static malware analysis of the software program based on identifying the exit of the software program and/or the forced kill of the software program. The device generates static malware analysis results based on performing the static malware analysis of the software program, and combines the dynamic malware analysis results and the static malware analysis results to generate combined malware analysis results. The device performs one or more actions based on the combined malware analysis results.