Malware Termination via Command Hooking and Return Value Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing verification devices fail to detect malware with anti-analysis functions, allowing such malware to evade detection and infect terminal devices despite being executed on a debugger, as they terminate their operations to avoid analysis, leading to potential unauthorized access and data theft.
Innovation Solution
A device and method that include a processor and memory configured to hook commands transmitted from the operating system to hardware, storing known malware commands and responding with information that causes the malware to terminate its operation, thereby preventing malicious activity by simulating the environment of a previous non-malicious execution, ensuring the malware does not start malignant operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware with anti-analysis functions is executed on a verification device, then the malware terminates its operation to avoid detection, but this causes the verification device to fail in detecting and preventing the malware
Solution Approach 1:
The verification device performs preliminary actions by storing command information and return value information in advance before the malware executes. When the malware runs, the device compares the actual commands and return values against the pre-stored information to detect discrepancies that indicate anti-analysis behavior, enabling detection before the malware can terminate its operation.
Solution Approach 2:
The verification device implements feedback by continuously monitoring and comparing the malware's actual command execution and return values against the expected values stored in advance. This feedback mechanism allows the device to identify when the malware is behaving abnormally (terminating due to anti-analysis detection) and take appropriate countermeasures.
2Ease of operation
If the verification device executes malware in a standard debugging environment, then the malware may detect the debugging environment and terminate, but executing without detection mechanisms allows malware to run undetected
Solution Approach 1:
The verification device segments the detection process into distinct components: command interception, return value comparison, and anomaly detection. By dividing the verification process into these separate functional segments, the device can maintain a standard debugging environment while systematically checking for malware anti-analysis behavior through command and return value validation.
3Measurement precision
If the verification device stores and compares command information, then it can detect malware behavior, but this increases the complexity of the verification system
Solution Approach 1:
The verification device creates copies of command information and return value data for comparison purposes. By storing these informational copies in advance and comparing them against actual runtime values, the device achieves precise malware behavior detection without requiring complex analysis algorithms, thereby reducing overall system complexity while maintaining high measurement precision.
Data Source
AI summary
A device includes: a memory configured to store in advance a command transmitted from malware to hardware via an operating system; and a processor coupled to the memory and configured to: hook a first command transmitted from the operating system to the hardware, and transmit information that causes the malware to determine to terminate operation of the malware to the operating system when the hooked first command corresponds with the command stored in the memory.