Malware Detection via Scalable Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and obfuscation techniques used by malware render existing virus detection methods obsolete, making it difficult for computer systems to detect and protect against malicious software effectively.
Innovation Solution
A system and method for malicious software detection and analysis that involves analyzing binary executables through scalable non-virtual and virtual execution environments to generate runtime and deobfuscation data, which is then stored in shared and private databases, allowing for efficient identification and remediation of malware despite obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional virus detection techniques (such as file signature or code detection) are used, then the detection process is simple and fast, but the detection accuracy deteriorates due to obfuscation techniques by malware creators
Solution Approach 1:
The patent introduces sandbox environments as intermediary systems between the malware and the analysis system. These sandboxes execute the malware in isolated virtual machines, allowing observation of actual runtime behavior without direct exposure to the host system. This intermediary layer enables accurate detection of obfuscated malware by capturing its true operational characteristics rather than relying on surface-level code analysis.
Solution Approach 2:
The patent replaces traditional mechanical code-based detection methods with behavioral analysis through automated execution. Instead of manually analyzing static code signatures, the system automatically executes malware in sandboxed environments and monitors its runtime behavior, replacing static mechanical analysis with dynamic automated observation of actual malware operations.
2Measurement precision
If malware analysis is performed through multiple execution environments to handle obfuscation, then detection accuracy improves, but the time and computational resources required increase significantly
Solution Approach 1:
The patent implements preliminary actions by pre-configuring multiple sandbox environments with different execution contexts before malware analysis begins. These sandboxes are prepared in advance with various operating systems, applications, and network configurations, allowing immediate execution of malware without setup delays. This preliminary preparation reduces analysis time while maintaining multiple execution environments for accurate detection.
Solution Approach 2:
The patent changes execution parameters by varying sandbox configurations across different dimensions such as operating system type, available applications, network access levels, and system resources. By systematically varying these parameters across multiple sandboxes, the system efficiently identifies malware behavior patterns without requiring exhaustive analysis in every possible environment, thus reducing overall analysis time.
3Measurement precision
If comprehensive runtime data and deobfuscation data are collected from multiple execution environments, then malware analysis accuracy improves, but data management and storage complexity increase
Solution Approach 1:
The patent segments collected data into distinct categories such as runtime behavior data, deobfuscation data, system state data, and network communication data. Each data type is stored in separate structured formats within the database, allowing efficient retrieval and analysis of specific data types without processing entire datasets. This segmentation reduces data management complexity while preserving comprehensive analysis capabilities.
Solution Approach 2:
The patent implements a universal database schema that can accommodate multiple types of malware analysis data from different sandbox environments through a standardized structure. This multi-functional database design allows the same storage system to handle diverse data types (runtime traces, deobfuscation outputs, system states) uniformly, simplifying data management while supporting comprehensive cross-environment comparison and analysis.
Data Source
AI summary
Embodiments of the invention describe systems and methods for malicious software detection and analysis. A binary executable comprising obfuscated malware on a host device may be received, and incident data indicating a time when the binary executable was received and identifying processes operating on the host device may be recorded. The binary executable is analyzed via a scalable plurality of execution environments, including one or more non-virtual execution environments and one or more virtual execution environments, to generate runtime data and deobfuscation data attributable to the binary executable. At least some of the runtime data and deobfuscation data attributable to the binary executable is stored in a shared database, while at least some of the incident data is stored in a private, non-shared database.