Malware Detection via Execution State Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated malware evades detection by using encryption, packing, and evasive techniques, making it difficult for current security systems to analyze and classify, leading to potential data loss and high recovery costs.
Innovation Solution
A security server analyzes the execution of suspicious data to detect triggers indicating unpacked malware, extracts portions for further analysis, and uses machine-learning based classification models to identify and prioritize states of execution, eliminating the need to fully unpack malware for detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malware is encrypted or packed to avoid detection, then detection difficulty increases, but analysis capability decreases
Solution Approach 1:
The system performs preliminary unpacking of malware in a controlled virtual environment before analysis. By executing the malware in a sandbox and capturing its unpacked state from memory, the system obtains analyzable code without requiring manual decryption or packing removal, thus maintaining both detection difficulty and analysis capability
Solution Approach 2:
A virtual machine sandbox acts as an intermediary between the encrypted/packed malware and the analysis system. The malware executes in this isolated environment, automatically unpacking itself, while the analysis system observes the unpacked state without directly interacting with the protected malware, resolving the contradiction between encryption protection and analysis accessibility
2Measurement precision
If full malware unpacking is performed for analysis, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system extracts only the necessary unpacked malware state from memory at specific trigger points during execution, rather than performing complete unpacking. This selective extraction captures sufficient information for accurate classification while minimizing processing time and resource consumption
Solution Approach 2:
The system performs partial unpacking by capturing malware at strategic execution states where sufficient information is available for classification. This partial action approach achieves adequate detection accuracy without the time cost of complete unpacking, as the malware's malicious behavior patterns are already manifest at these intermediate states
3Reliability
If sophisticated evasive techniques are used by malware, then malware survival rate increases, but security system complexity increases
Solution Approach 1:
The malware's own evasive techniques and decryption routines work against it by automatically unpacking the malware in the sandbox environment. The system leverages the malware's self-contained unpacking capabilities rather than requiring external decryption tools, maintaining security system simplicity while countering evasive techniques
Solution Approach 2:
The system converts the malware's protective encryption and packing mechanisms into benefits by using the malware's own execution process to automatically unpack it. The evasive techniques that normally protect malware become the mechanism by which the malware reveals its true nature in the sandbox, turning the harm into a detection advantage
Data Source
AI summary
A network device may include a memory and one or more processors configured to analyze execution of suspicious data; detect one or more states of execution of the suspicious data; determine that the one or more states of execution are to be assigned a priority level; and extract at least a portion of the suspicious data from one or more locations based on determining that the one or more states of execution are to be assigned a priority level.