Malware Evasion Code Detection and Rectification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic analysis of malware is vulnerable to evasion techniques, as it typically analyzes malware on a single execution path, preventing proper evaluation in sandboxes and other platforms due to evasion codes that detect and adapt to specific computing environments.
Innovation Solution
A malware detection system with an evasion code detector that identifies semantic patterns in conditional statements, inserts breakpoints, compares expected and actual values, and alters the execution path to counteract evasion codes, allowing for the true nature of the sample program to be revealed during runtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If dynamic analysis is performed on a single execution path, then the analysis process is simple, but the analysis is vulnerable to evasion techniques and cannot properly evaluate malware
Solution Approach 1:
The patent segments the malware execution analysis into multiple execution paths by identifying conditional statements and creating separate analysis threads for each possible path. This allows the system to systematically explore different behavioral scenarios rather than relying on a single execution trace, thereby improving reliability while managing complexity through structured division of the analysis task.
Solution Approach 2:
The patent performs preliminary identification and classification of conditional statements before executing the malware. By pre-analyzing the control flow structure and identifying potential evasion points in advance, the system prepares multiple execution paths ahead of time, enabling more comprehensive evaluation without significantly increasing the complexity of the actual analysis process.
2Adaptability or versatility
If evasion code is present in malware, then the malware can adapt to computing environments, but the true malicious nature cannot be revealed during runtime analysis
Solution Approach 1:
The patent applies preliminary anti-action by identifying patterns characteristic of evasion code before the malware executes its adaptive logic. The system pre-configures monitoring for specific behavioral patterns and conditional structures that indicate evasion mechanisms, allowing it to anticipate and counteract the malware's adaptation attempts before they can hide the true malicious intent.
Solution Approach 2:
The patent employs dynamic analysis by monitoring the malware's execution behavior in real-time and adapting the analysis approach based on observed patterns. When evasion code is detected through pattern matching, the system dynamically adjusts by exploring alternative execution paths or modifying the analysis environment, thereby revealing the malware's true nature despite its adaptive capabilities.
3Reliability
If multiple execution paths are analyzed, then malware evasion can be countered, but the analysis complexity and time increase
Solution Approach 1:
The patent applies partial action by selectively analyzing only those execution paths that are most likely to reveal malicious behavior. Rather than exhaustively exploring every possible path, the system prioritizes paths based on risk assessment and pattern matching results, analyzing a sufficient subset of paths to detect evasion techniques while avoiding the time cost of complete path exploration.
Data Source
AI summary
A malware detection system for evaluating sample programs for malware incorporates an evasion code detector. The evasion code detector includes semantic patterns for identifying conditional statements and other features employed by evasion code. The system inserts breakpoints at conditional statements, compares expected and actual evaluated values of conditional variables of the conditional statements, and changes the execution path of the sample program based on the comparison. Changing the execution path of the sample program to an expected execution path counteracts the evasion code, allowing for the true nature of the sample program to be revealed during runtime.