Malware Classification via Memory Artifact Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network security measures struggle to effectively detect and mitigate evolving malware tactics, particularly those employing anti-emulation and dynamic analysis evasion techniques, due to reliance on static file structure analysis and inadequate consideration of memory artifacts.
Innovation Solution
A system and method that utilize dynamic analysis by executing files in a sandbox to monitor memory artifacts, such as API pointers, page permission modifications, and OS structure changes, combined with machine learning models trained on memory and dynamic execution log data, to classify files as malicious or benign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional static file structure analysis is used for malware detection, then the detection system is simple to implement, but the detection accuracy deteriorates against evolving malware tactics
Solution Approach 1:
The patent transitions from static file structure analysis to dynamic analysis by executing files in a sandbox environment and monitoring memory artifacts during runtime. This allows the system to capture behavioral characteristics that change over time, such as API pointer modifications, page permission changes, and OS structure alterations, thereby improving detection accuracy against evolving malware while maintaining implementation feasibility through automated sandboxing
Solution Approach 2:
The patent adds a new dimension of analysis by moving from static file structure (spatial dimension only) to dynamic runtime behavior (temporal dimension). By monitoring memory artifacts across multiple time points during file execution, the system creates a temporal profile of malware behavior, enabling detection of tactics that are invisible in static analysis
2Measurement precision
If dynamic analysis with sandbox execution is implemented, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent introduces a sandbox environment as an intermediary layer between the malware and the host system. This isolated execution environment captures memory artifacts without affecting the host, simplifying the overall system architecture by containing complexity within the sandbox while maintaining clean interfaces for data collection and analysis
Solution Approach 2:
The patent creates a virtual copy of the execution environment through sandboxing, allowing dynamic analysis of potentially harmful files without risking the host system. This copying approach enables comprehensive monitoring of memory artifacts, API pointers, and OS structures while isolating complexity to the virtual environment
3Measurement precision
If memory artifact monitoring is performed during execution, then malware classification accuracy improves, but processing time increases
Solution Approach 1:
The patent performs preliminary monitoring of memory artifacts during sandbox execution, capturing key indicators such as API pointer modifications, page permission changes, and OS structure alterations before the malware can execute its full malicious payload. This preliminary action allows the system to classify files based on early behavioral patterns, reducing the time required for complete analysis while maintaining high accuracy
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting malicious files. The method includes (a) receiving a sample for malware analysis, (b) applying a machine learning model to obtain a classification for the sample based at least in part on (i) memory artifact data associated with the sample, and (ii) at least one of dynamic execution log data for the sample and static file structures associated with the sample, and (c) determining whether the sample is malicious based at least in part on the classification.