Malware Detection via AST Correlation of Generated Objects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network-based malware detection systems often generate false negatives due to their inability to effectively detect malicious activities that are configured to cloak themselves, leading to inadequate cyber-security measures.
Innovation Solution
A malware detection system that processes objects received by analyzing their features and any generated objects using Abstract Syntax Trees (ASTs) in conjunction with static and dynamic analysis, employing machine learning and correlation engines to determine the probability of maliciousness, thereby enhancing detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional static analysis and dynamic analysis engines are used to detect malware, then known malware can be identified through signature matching and behavior analysis, but false negatives occur when malware is configured to cloak malicious activities
Solution Approach 1:
The malware detection process is segmented into multiple independent analysis stages: static analysis of the first object, execution in virtual machine environment, detection of generated objects, and analysis of relationships between objects. Each stage produces independent correlation results that are combined to form the final detection decision, improving reliability against cloaked malware.
Solution Approach 2:
The system implements nested analysis by placing the first object inside a virtual machine environment for execution, then detecting and analyzing generated objects that are nested within the execution context. This multi-layered nesting approach allows detection of cloaked malware that attempts to hide within legitimate execution environments.
2Adaptability or versatility
If multiple analysis engines are combined to classify network content as malicious, then detection coverage increases, but false negatives persist when malware cloaks malicious activities
Solution Approach 1:
The system implements feedback loops where the analysis of generated objects feeds back into the classification of the original object. The correlation engine continuously refines the maliciousness probability by incorporating evidence from multiple analysis stages, including static analysis results, dynamic execution behavior, and generated object characteristics, thereby reducing false negatives.
Solution Approach 2:
The system adds a new dimension to malware detection by analyzing the relationships and generation patterns between objects, rather than only analyzing individual objects in isolation. This dimensional expansion from single-object analysis to multi-object relationship analysis enables detection of cloaked malware that appears benign when analyzed alone.
3Loss of information
If conventional malware detection systems analyze network content using signature databases and static/dynamic analysis, then known malware patterns can be identified, but the systems fail to detect malware configured to cloak malicious activities
Solution Approach 1:
The system performs preliminary static analysis of the first object before execution to identify suspicious characteristics and establish a baseline for comparison. This preliminary action prepares the system to detect deviations from expected behavior during virtual machine execution, improving detection of cloaked malware that attempts to hide its malicious nature.
Solution Approach 2:
The virtual machine environment serves as an intermediary between the malware sample and the detection system. It provides a controlled sandbox environment that isolates the execution of suspicious objects while allowing observation of their behavior and generated outputs, enabling detection of cloaked malware without direct exposure to the analysis system.
Data Source
AI summary
A computerized method to identify malicious code generated by seemingly benign objects is described. The generated malware detection system described identifies generated objects (code) and analyzes each generated object to collect features which may be associated with maliciousness. The analysis may determine if an Abstract Syntax Tree (AST) representation of the generated object is correlated with known malware ASTs. Correlation of the features identified during processing of the generated objects, including the sequences of generated object, may be used in classifying the object as malicious. The malware detection system may communicate with the one or more endpoint devices to influence detection and reporting of behaviors and malware by those device(s).