Malware Detection via Downloader-Downloaded File Linkage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems fail to accurately identify malicious files when a downloader file, initially deemed non-malicious, downloads additional malware files, leading to potential future infections due to the complexity of tracking relationships between these files.
Innovation Solution
Implementing a method where a security device analyzes both the downloader file and the downloaded file for malware, storing linkage information to adjust malware scores based on the relationship between them, thereby enhancing detection accuracy by reassessing the downloader file's likelihood of being malicious if it downloads files with high malware scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a downloader file is analyzed in isolation for malware, then the analysis process is simple and fast, but the detection accuracy is low because the file may download additional malware files that are not detected
Solution Approach 1:
The patent executes the downloader file in a sandbox environment before final malware detection to capture what files it downloads. This preliminary execution reveals the true malicious intent of the downloader file, allowing the system to detect malware that would otherwise be missed by static analysis alone.
Solution Approach 2:
The system uses the download behavior of the downloader file as feedback to adjust its malware score. If the downloader file downloads files with high malware scores, the system feeds this information back to increase the downloader's own malware score, improving detection accuracy through iterative reassessment.
2Measurement precision
If the system executes the downloader file in a sandbox to capture downloaded files, then detection accuracy improves, but the time and computational resources required increase
Solution Approach 1:
The system performs partial execution of the downloader file in the sandbox - just enough to capture the files it downloads, without necessarily executing the entire malicious payload. This approach achieves the necessary detection accuracy while limiting the time and resources consumed by the sandbox analysis.
3Reliability
If the system analyzes both the downloader file and downloaded files with linkage tracking, then comprehensive malware detection is achieved, but the device complexity and processing requirements increase
Solution Approach 1:
The sandbox environment serves as an intermediary between the downloader file and the analysis system. It captures the download behavior and provides this information to the malware scoring system, which then uses linkage information to reassess the downloader's malware score. This intermediary approach manages complexity while achieving comprehensive detection.
Data Source
AI summary
A device may analyze a first file for malware. The device may determine that the first file causes a second file to be downloaded. The device may store linkage information that identifies a relationship between the first file and the second file based on determining that the first file causes the second file to be downloaded. The device may analyze the second file for malware. The device may determine a first malware score for the first file based on analyzing the second file for malware and based on the linkage information. The device may determine a second malware score for the second file based on analyzing the first file for malware and based on the linkage information.