Malware Detection via Execution Monitoring and Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems fail to detect obscured malware during payload execution due to scanning only in non-execution forms, allowing malicious code to go undetected.
Innovation Solution
A system and method that involves interface monitoring to detect payload execution, scanning process memory for signatures of unwanted data, and performing behavioral analysis to identify and detect malware, even when it is obscured in a non-executable form.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security systems scan unwanted data only in non-execution form, then the scanning process is simple and fast, but obscured malware can go undetected
Solution Approach 1:
The system performs preliminary scanning of the payload in its non-executable form before execution, and then performs a second scanning during execution. This preliminary action allows the system to detect obvious threats early while preparing for more sophisticated detection during the actual execution phase, thereby improving detection accuracy without overwhelming the system with complexity all at once.
Solution Approach 2:
The detection process is segmented into multiple phases: initial scanning of the payload in non-executable form, monitoring during execution, and behavioral analysis. This segmentation allows each phase to focus on specific detection tasks, improving overall detection accuracy while managing system complexity through divided responsibilities.
2Reliability
If security systems monitor payload execution and perform behavioral analysis, then obscured malware can be detected, but the system complexity and resource consumption increase
Solution Approach 1:
The system performs partial monitoring during payload execution by focusing on specific interfaces and memory regions that are most likely to contain obscured malware indicators. This partial action approach maintains high detection accuracy for critical threats while reducing the overall complexity and resource consumption compared to comprehensive monitoring of all system activities.
Solution Approach 2:
The system introduces an intermediary layer that monitors interfaces between the payload and the operating system, as well as memory regions. This intermediary approach enables detection of obscured malware through behavioral analysis without requiring direct intervention in the payload execution, thereby improving detection capability while managing system complexity through a dedicated monitoring layer.
3Productivity
If conventional security systems only scan non-executable forms, then the scanning process is fast, but detection capability is limited
Solution Approach 1:
The system performs a quick preliminary scan of the payload in its non-executable form to maintain high scanning speed for obvious threats, then triggers execution-based monitoring and behavioral analysis when suspicious patterns are detected. This preliminary action preserves scanning speed for routine cases while enabling enhanced detection capability when needed.
Solution Approach 2:
The system applies full execution monitoring and behavioral analysis only to payloads that exhibit suspicious characteristics during the initial fast scan, rather than applying these resource-intensive methods to all payloads. This partial action maintains high overall scanning productivity while ensuring enhanced detection capability is applied to potentially malicious content.
Data Source
AI summary
A system, method, and computer program product are provided for detecting unwanted data based on scanning associated with a payload execution and a behavioral analysis. In use, an execution of a payload is detected, utilizing interface monitoring. Additionally, process memory associated with the execution of the payload is scanned. Further, a behavioral analysis is performed. Still yet, unwanted data is detected based on the scanning and the performance of the behavioral analysis.