Iterative Malware Detection via Entropy Analysis and Dynamic Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, particularly Pre-Execution analysis, struggle with encrypted or packed malware samples, as they fail to effectively analyze encrypted code and are resource-intensive, leading to low detection rates and performance degradation.
Innovation Solution
Combining static and dynamic analysis techniques, where static analysis estimates file entropy to identify suspicious files, and dynamic methods reveal execution behavior, with machine-learning models re-estimating verdicts using system-level interceptors and user-mode hooks to improve detection accuracy, especially by decrypting and re-evaluating data blocks iteratively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static analysis is used to analyze encrypted or packed malware samples, then analysis speed is improved, but detection accuracy deteriorates because encrypted code cannot be effectively analyzed
Solution Approach 1:
The system performs preliminary static analysis to identify encrypted or packed files based on file attributes and entropy estimation. When encryption is detected, the system prepares for dynamic analysis by setting up the execution environment and interceptors before the malware actually executes, allowing seamless transition to dynamic analysis mode.
Solution Approach 2:
The system dynamically adapts its analysis approach based on file characteristics. For encrypted or packed files, it transitions from static to dynamic analysis mode. During execution, it dynamically intercepts decryption operations and updates the analysis model in real-time, allowing the analysis method to change based on the malware's behavior.
2Measurement precision
If dynamic analysis is used to analyze malware execution, then detection accuracy is improved, but system resource consumption and analysis time increase substantially
Solution Approach 1:
The system segments the malware execution analysis into discrete interceptable operations. Instead of monitoring the entire execution process continuously, it segments analysis into specific API calls and memory operations that are intercepted using hooks. This allows focused analysis only at critical points where malware behavior is revealed.
Solution Approach 2:
The system implements feedback loops where decryption operations are intercepted, decrypted data is analyzed, and analysis results feed back into the decision-making process. The machine learning model continuously receives feedback from intercepted operations and updates its verdict, allowing the system to stop analysis early when sufficient evidence is gathered, reducing overall resource consumption.
3Measurement precision
If traditional emulation is used to analyze malware, then deep analysis capability is improved, but analysis time increases and malware can detect the emulator environment to stop execution
Solution Approach 1:
The system introduces system-level interceptors and hooks as intermediaries between the malware and the emulator environment. These interceptors capture decryption and execution operations without requiring the malware to run in a fully emulated environment. This allows the system to obtain deep analysis data while running malware in a more native-like environment that is harder to detect.
Solution Approach 2:
The system sets up interceptors and hooks in advance before malware execution begins. By pre-configuring the interception points for decryption APIs and memory operations, the system eliminates the need for time-consuming runtime environment setup and allows immediate analysis upon malware execution, significantly reducing analysis time.
4Reliability
If sandboxing is used to isolate malware execution, then security is improved, but resource consumption increases and real-time analysis capability is reduced
Solution Approach 1:
The system uses self-service techniques where the malware's own decryption operations are intercepted and analyzed. Instead of requiring a full sandbox environment to analyze malware behavior, the system leverages the malware's inherent decryption process and intercepts it using system-level hooks. This allows analysis without the overhead of a complete sandbox infrastructure.
Solution Approach 2:
The system segments the analysis function from the execution environment. Rather than isolating the entire execution process in a resource-intensive sandbox, it segments the critical analysis function into specific intercepted API calls and memory operations. This allows malware to execute in a more efficient environment while still providing isolated analysis of the decrypted code.
Data Source
AI summary
A system and method of anti-malware analysis including iterative techniques. These techniques are used to create a file attribute tree used by a machine learning analyzer to identify malicious files.