Malware Family Identification via Dynamic API Profile Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antimalware techniques struggle to identify malware and determine whether it belongs to a specific malware family, especially when faced with zero-day threats and polymorphic packers, leading to false positives and inability to classify variants of known malware families.
Innovation Solution
The use of profile signatures for malware family identification involves executing potential malware samples in a virtual machine environment, performing dynamic analysis, and monitoring runtime contexts such as API activities and network traffic to classify samples as part of a known malware family, with a security cloud service providing feedback for appropriate responses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current antimalware techniques are used to identify malware, then detection capability is maintained for known malware, but inability to identify zero-day threats and polymorphic packers occurs
Solution Approach 1:
The system performs preliminary dynamic analysis by executing malware samples in a sandbox environment before making identification decisions. This preliminary execution captures runtime behavior, API calls, and network traffic patterns that serve as the basis for identifying both known and unknown malware families, including zero-day threats that lack static signatures.
Solution Approach 2:
The system transitions from static analysis parameters to dynamic runtime parameters by monitoring malware behavior during execution. This includes capturing API call sequences, registry modifications, file system changes, and network communication patterns, which provide adaptable identification criteria that work across different malware variants and families.
2Measurement precision
If profile signatures and dynamic analysis are used to identify malware families, then classification accuracy for malware variants is improved, but analysis time and computational resources increase
Solution Approach 1:
The system performs partial dynamic analysis by monitoring a selected subset of runtime parameters and behaviors rather than capturing every possible action. This selective monitoring approach captures sufficient information for accurate malware family identification while reducing overall analysis time and computational overhead.
Solution Approach 2:
The system creates behavioral profiles and signatures from analyzed malware samples that can be reused for identifying similar variants. These copied identification patterns enable faster recognition of known malware families without requiring full dynamic analysis of each new sample, significantly reducing repeated analysis time.
3Object-affected harmful factors
If sandbox environment is used for dynamic analysis, then ability to safely execute and monitor malware behavior is improved, but system complexity and infrastructure requirements increase
Solution Approach 1:
The system introduces a sandbox environment as an intermediary layer between the malware sample and the host system. This virtualized sandbox acts as a mediator that isolates malware execution, capturing its behavior while preventing direct access to or damage of the underlying system, thus enabling safe analysis without exposing the host.
Solution Approach 2:
The system segments the analysis environment into isolated virtual components within the sandbox, separating malware execution from the host system. This segmentation allows independent monitoring of specific runtime parameters, API calls, and network traffic without requiring complex integrated infrastructure, simplifying the overall system architecture.
Data Source
AI summary
A potential malware sample is received from a security device at a server associated with a security cloud service. The sample is executed in a sandbox environment on the server, including by monitoring interaction of the sample with an application program interface (API), provided by the sandbox environment, in order to obtain an API log. It is determined whether the sample is associated with a known malware family including by determining, based at least in part on the API log, if the sample created an executable file and if the sample registered the executable file in a run key. If it is determined that the sample is associated with a known malware family, then an alert is generated.