Malware Identification via Dependency Graph Tracing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to accurately identify malicious sites and download data, leading to potential misidentification of legitimate sites as malware download sites and missed detection of malicious data, especially in multistage program code execution scenarios.
Innovation Solution
A device and method that monitors malware, acquires log data on download data and communication relations, creates a dependency relation graph, and identifies malicious nodes by tracing edges from terminal to start points using known maliciousness information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all communication destinations obtained from dynamic analysis are included in the blacklist, then communication to malware download sites is obstructed, but legitimate sites may be erroneously blocked
Solution Approach 1:
The patent segments the identification process into multiple stages: first creating a dependency relation graph that separates communication destinations into different categories (malware download sites, legitimate sites, etc.), then selectively blacklisting only those identified as malicious. This segmentation allows legitimate sites to be excluded from the blacklist while maintaining blocking of actual malware sources.
Solution Approach 2:
Instead of directly identifying malicious sites from raw communication data, the patent inverts the approach by first establishing what constitutes legitimate communication patterns through dependency analysis, then identifying deviations from these patterns as malicious. This inversion reduces false positives by establishing a baseline of normal behavior.
2Reliability
If dynamic analysis is used to obtain blacklist data, then malware download sites can be identified, but multistage malicious structures may be missed
Solution Approach 1:
The patent adds a new dimension of analysis by creating a dependency relation graph that visualizes and analyzes the relationships between malware, communication destinations, and downloaded files. This graphical dimension allows for the detection of multistage malicious structures that cannot be identified through traditional linear dynamic analysis alone.
Solution Approach 2:
The patent implements feedback mechanisms where the dependency relation graph continuously updates based on analyzed malware behavior, and this updated information feeds back into the identification process. This allows the system to learn from detected patterns and improve detection of multistage structures over time.
3Measurement precision
If dependency relation graph analysis is performed to accurately identify malicious sites, then detection precision improves, but system complexity increases
Solution Approach 1:
The patent performs preliminary actions by pre-defining the structure and nodes of the dependency relation graph before analysis begins. This preliminary setup includes identifying potential malware, communication destinations, and file objects in advance, which simplifies the subsequent analysis process and reduces system complexity during execution.
Data Source
AI summary
An identifying device monitors malware to be analyzed and acquires, as log data, the malware, download data downloaded from a communication destination, and a relation of data transfer performed with the malware or the communication destination of the download data. Then, the identifying device creates, by using the acquired log data, a dependency relation graph that is a digraph in which the malware, download data, and communication destination are set as nodes and a dependency relation of each node is set as an edge. Then, the identifying device detects a malicious node by collating the respective nodes of the created dependency relation graph with the known maliciousness information, and traces an edge in a direction from a terminal point to a start point while setting the malicious node as a base point, and then identifies the traced node as a new malicious node.