Malware Detection Appliance Using Static and Dynamic URL Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are inadequate in identifying malicious links in electronic messages, particularly polymorphic malware, and often result in delayed detection and propagation of malware, with existing solutions having limited effectiveness against advanced persistent threats.
Innovation Solution
A system comprising malware detection appliances that extract and analyze URL links using local signatures, with suspicious links sent to a remote analysis system for further evaluation in a sandboxed environment, generating new signatures for future detection, and employing a combination of static and dynamic analysis to improve accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based scanning is used to detect malware, then known malware can be identified, but polymorphic malware and advanced persistent threats escape detection due to their ability to mutate
Solution Approach 1:
The system performs preliminary static analysis of URL links before they are executed, extracting and examining link characteristics in advance. This allows detection of malicious patterns in links before they can be activated, addressing the limitation of signature-based scanning that only detects known malware after execution occurs.
Solution Approach 2:
The detection process is segmented into multiple phases: static analysis phase for URL link examination, dynamic analysis phase for sandboxed execution monitoring, and verification phase for result confirmation. This segmentation allows each phase to specialize in specific detection techniques, improving overall detection accuracy against polymorphic malware while reducing false positives.
2Reliability
If two-phase malware detection with sandboxing is implemented, then detection accuracy improves, but system complexity and processing time increase
Solution Approach 1:
Static analysis is performed as a preliminary action before dynamic sandboxed execution. This filters out easily identifiable malicious links early, reducing the number of links that require costly dynamic analysis and thereby reducing overall system complexity while maintaining high detection accuracy.
Solution Approach 2:
The system applies partial action by only performing full dynamic sandboxed analysis on links that pass the static analysis threshold, rather than analyzing all links through the complete two-phase process. This selective approach reduces processing complexity while maintaining detection accuracy for malicious content.
3Speed
If real-time link analysis is performed, then protection speed improves, but processing resources and false positives increase
Solution Approach 1:
Static analysis serves as a fast preliminary filter that quickly identifies obviously malicious links without requiring resource-intensive dynamic execution. This enables real-time processing of high volumes of links while consuming minimal resources, as only links passing the static filter require additional dynamic analysis.
Solution Approach 2:
The analysis process is segmented into a fast static analysis stage and a resource-intensive dynamic analysis stage. This segmentation allows the system to process links rapidly through static analysis while reserving dynamic resources only for links that require deeper inspection, optimizing the balance between processing speed and resource consumption.
Data Source
AI summary
According to one embodiment, in response to receiving a plurality of uniform resource locator (URL) links for malicious determination, any known URL links are removed from the URL links based on a list of known link signatures. For each of remaining URL links that are unknown, a link analysis is performed on the URL link based on link heuristics to determine whether the URL link is suspicious. For each of the suspicious URL links, a dynamic analysis is performed on a resource of the suspicious URL link. It is classified whether the suspicious URL link is a malicious link based on a behavior of the resource during the dynamic analysis.