Malware Detection via Code Interpretation and Environment Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated malware attacks use multi-stage strategies, where the first stage avoids detection by executing only in a specific target environment, making it difficult for security solutions to detect malicious behavior, as they often rely on static analysis and golden image environments which may not capture the exact target environment characteristics.
Innovation Solution
A system and method that interprets the code of suspect files to determine potential execution paths and conditional tests without executing the code, allowing for the emulation of environment checks and detection of malicious behavior, thereby preventing entry into a computing environment if malicious actions are identified.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static analysis and golden image environments are used for malware detection, then detection speed is improved, but detection accuracy deteriorates because the exact target environment characteristics cannot be captured
Solution Approach 1:
The system dynamically adapts the analysis environment to match the target environment characteristics by modifying environment parameters based on reconnaissance data, allowing accurate detection while maintaining speed through automated environment configuration
Solution Approach 2:
The system creates a dynamic copy of the target environment characteristics by extracting environmental fingerprints and replicating them in the analysis environment, enabling accurate malware behavior observation without requiring the actual target environment
2Object-affected harmful factors
If the first stage sample is designed to execute only in a specific target environment, then the malicious actor avoids detection by automated security solutions, but the security solution cannot detect malicious behavior without knowing the exact target environment
Solution Approach 1:
The system performs preliminary reconnaissance analysis to identify environmental characteristics and dependencies before full execution, allowing it to prepare the appropriate analysis environment in advance and detect malicious behavior without needing to know the exact target environment beforehand
Solution Approach 2:
The system introduces an intermediary environment that bridges the gap between the controlled analysis environment and the unknown target environment, using environmental fingerprinting and dynamic configuration to translate target environment characteristics into detectable analysis conditions
3Loss of information
If the first stage sample performs reconnaissance of the environment, then the malicious actor can determine target environment characteristics, but static analysis tools cannot determine the environment requirements ahead of time
Solution Approach 1:
The system allows the malware sample to perform its own reconnaissance actions within a controlled analysis environment, automatically gathering environmental information that would otherwise require complex analysis tools to extract, thereby simplifying the analysis process while capturing complete environment dependencies
Data Source
AI summary
Code of a target suspect file is interpreted, instead of being executed, to determine potential malicious behavior of the target suspect file. If there are multiple execution paths, an action that would be performed in an execution path that is dependent on a conditional test is interpreted to determine what its behavior would be. If the target suspect file would perform a potential detection-avoidance technique, the potential detection-avoidance technique is bypassed, and actions that the target suspect file would perform are interpreted regardless of the detection-avoidance technique.