Malware Detection via Monitor Component Discrepancy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional automated execution environments have deficiencies and vulnerabilities that allow malicious files to evade detection during malware analysis, as they may bypass hooks inserted in API functions, leading to inaccurate tracking of file behaviors.
Innovation Solution
The system monitors files undergoing malware analysis through a plurality of monitor components, detects suspicious discrepancies among these components, and determines if the file demonstrates detection-evasion behaviors by identifying which components observe and which do not observe computing activity, thereby classifying the file as potentially malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hooks are inserted in API functions to monitor computing activity, then detection capability is improved, but malicious files can bypass these hooks leading to detection evasion
Solution Approach 1:
The monitoring system is divided into multiple independent monitor components (first monitor component and second monitor component) that operate in parallel. Each monitor component independently tracks computing activity, and discrepancies between their observations are analyzed to detect evasion behaviors. This segmentation prevents malicious files from bypassing all monitors simultaneously.
Solution Approach 2:
A comparison mechanism acts as an intermediary between monitor components, analyzing discrepancies in their observations. When one monitor component detects computing activity that another misses, the system uses this intermediary analysis to identify potential detection-evasion behaviors, adding a layer of indirect detection that complements direct monitoring.
2Measurement precision
If multiple monitor components are used to detect evasion behaviors, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments monitoring functions into distinct components with specialized roles. Each monitor component focuses on specific computing activity detection, and the segmentation allows for modular implementation where each component can be optimized independently, managing overall system complexity through functional division.
Solution Approach 2:
Multiple monitor components are merged into a unified detection system that combines their observations. The system merges data from different monitor components and applies consistent analysis rules, achieving improved detection accuracy through combination while managing complexity through standardized integration processes.
Data Source
AI summary
The disclosed computer-implemented method for identifying detection-evasion behaviors of files undergoing malware analyzes may include (1) monitoring, by a plurality of monitor components related to an automated execution environment, a file that is undergoing a malware analysis in the automated execution environment, (2) detecting a suspicious discrepancy among the monitor components with respect to computing activity observed in connection with the malware analysis by (A) identifying a monitor component that has observed the computing activity in connection with the malware analysis and (B) identifying another monitor component that has not observed the computing activity in connection with the malware analysis, and then (3) determining, based at least in part on the suspicious discrepancy, that the file demonstrates a detection-evasion behavior that led to the other monitor component not observing the computing activity in connection with the malware analysis. Various other methods, systems, and computer-readable media are also disclosed.