Malware Context Profiling Through Network Behavior Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques are inadequate in identifying and mitigating evolving malware threats, as nefarious actors continually find ways to circumvent detection methods, leading to a need for improved identification and mitigation strategies.
Innovation Solution
A system utilizing static and dynamic analysis, combined with malware profiling, to identify and classify malware by analyzing network behavior patterns, complementing traditional signature-based detection with behavioral profiles to minimize false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional signature-based detection is used, then detection speed is maintained, but detection accuracy deteriorates due to evolving malware threats
Solution Approach 1:
The patent implements dynamic analysis that observes malware behavior in real-time during execution, allowing the detection system to adapt to new malware variants by analyzing actual runtime characteristics rather than relying on static signatures. This enables the system to detect evolving malware threats while maintaining detection accuracy through behavioral observation.
Solution Approach 2:
The patent performs preliminary static analysis to extract behavioral characteristics and create profiles before malware execution, establishing a baseline for comparison during dynamic analysis. This preliminary profiling enables faster detection decisions while maintaining accuracy by pre-characterizing malware behavior patterns.
2Reliability
If static analysis alone is used, then analysis speed is maintained, but detection completeness deteriorates
Solution Approach 1:
The patent divides malware analysis into two distinct phases: static analysis (examining malware without execution) and dynamic analysis (observing malware during execution). This segmentation allows the system to perform quick static checks first, then apply more time-consuming dynamic analysis only when needed, improving both completeness and time efficiency.
Solution Approach 2:
The patent merges static and dynamic analysis results to create comprehensive malware profiles that combine structural characteristics from static analysis with behavioral characteristics from dynamic analysis. This combination achieves detection completeness by leveraging both analysis types while managing time loss through selective application.
3Measurement precision
If behavioral profiling is implemented, then false positives are reduced, but system complexity increases
Solution Approach 1:
The patent changes the parameters used for malware identification from static signatures to dynamic behavioral parameters observed during execution. By monitoring runtime characteristics such as system calls, network activity, and file operations, the system reduces false positives while managing complexity through focused observation of key behavioral parameters.
Solution Approach 2:
The patent creates simplified behavioral profiles that copy and store characteristic execution patterns of malware families. These profiles serve as reference models for comparison during detection, reducing false positives by matching observed behavior against known patterns without requiring complex real-time analysis of all possible behaviors.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Analysis of samples for maliciousness is disclosed. A sample is executed and one or more network activities associated with executing the sample are recorded. The recorded network activities are compared to a malware profile. The malware profile comprises a set of network activities associated with executing a copy of a known malicious application. A verdict of "malicious" is assigned to the sample based at least in part on a determination that the recorded network activities match the malware profile. Also disclosed is use of a malware profile to determine whether a host has been compromised. For example, a set of log entries can be analyzed to locate entries that correspond to the malware profile. Based at least in part on identifying the set of entries matching the malware profile, a determination is made that a host was compromised.