Malware Dropper Detection via Static Code Stream Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems are ineffective in detecting zero-day malware droppers, as they rely on dynamic analysis and signature patterns that are slow to update, allowing malware to infect devices before detection, especially in cases of Microsoft Office-based malware droppers.
Innovation Solution
A network security system that uses static analysis to detect malware droppers by decoding files, processing code streams for indicators of compromise (IOCs) such as auto-launch, network download, and execution capabilities, without requiring the files to be executed or opened, allowing for real-time identification and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis and signature patterns are used for malware detection, then detection accuracy for known malware is improved, but detection speed and response time deteriorate due to slow signature updates
Solution Approach 1:
The patent performs static analysis on malware samples in advance to extract behavioral indicators and create detection rules before actual malware attacks occur. This preliminary extraction of IOCs from decoded file streams enables rapid detection without waiting for signature updates, resolving the contradiction between detection accuracy and response time.
2Reliability
If static analysis is used to detect malware without execution, then security against attacks is improved, but detection capability for zero-day malware deteriorates due to lack of behavioral observation
Solution Approach 1:
The patent replaces dynamic execution-based detection with static analysis of decoded file streams. By analyzing the structural and textual characteristics of code streams without executing the malware, the system maintains high security while detecting zero-day threats through behavioral indicators extracted from the static code structure.
3Measurement precision
If code streams are decoded and processed for IOC detection, then detection precision for zero-day malware is improved, but system complexity increases due to additional processing steps
Solution Approach 1:
The patent segments the malware detection process into distinct stages: obtaining the file, decoding to identify code streams, processing each stream for IOCs, and making detection decisions. This segmentation allows the system to manage complexity through modular processing while achieving high detection precision through systematic analysis of code stream characteristics.
Data Source
AI summary
A method comprises obtaining a potentially malicious file, decoding the file to identify one or more code streams, processing each of the identified code streams to determine the presence of respective ones of a set of indicators of compromise, determining whether the file is malicious based on the presence of one or more of the indicators of compromise in the code streams, and modifying access by a given client device to the file responsive to determining that the file is malicious.