Malware Detection via Instruction Count Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems fail to effectively identify obfuscated malicious code, which is scrambled and hidden within executable program modules, making it difficult to detect until it is fully assembled and executed.
Innovation Solution
A system and method that count specific types of program instructions before and during execution, comparing pre-execution and run-time counts to determine if significant differences exceed a threshold, indicating potential obfuscated malware, and terminate or suspend the program if malicious activity is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus obfuscation techniques are used to scatter and fragment malicious instructions, then the malware can escape detection by signature-based scanners, but the malicious code becomes difficult to detect until it is fully assembled during execution
Solution Approach 1:
The patent performs preliminary analysis of the executable file before execution to establish baseline instruction counts and characteristics. By pre-calculating and storing the expected instruction counts for each opcode type in the executable, the system creates a reference profile that enables later detection of unauthorized code assembly during runtime, thus resolving the detection difficulty without triggering the obfuscated malware
Solution Approach 2:
The system continuously monitors instruction counts during execution and compares them against the pre-established baselines. When discrepancies exceed predefined thresholds, the system triggers detection and termination actions. This feedback mechanism enables real-time detection of obfuscated malware assembly while maintaining normal operation within acceptable parameters
2Reliability
If the system monitors instruction counts continuously during execution, then obfuscated malware can be detected early, but the system complexity and processing overhead increase
Solution Approach 1:
Instead of monitoring all instructions equally, the system focuses on counting specific opcode types that are characteristic of malware assembly operations. By selectively monitoring only the most suspicious instruction categories rather than every single instruction, the system achieves effective malware detection with reduced computational overhead and simpler implementation
Solution Approach 2:
The system transforms the complex problem of analyzing instruction sequences and patterns into a simpler parameter-based approach by counting and comparing opcode frequencies. This parameter transformation converts a complex structural analysis problem into a straightforward numerical comparison task, significantly reducing system complexity while maintaining detection effectiveness
3Measurement precision
If threshold-based detection is used to identify significant instruction count differences, then false positives can be reduced, but some obfuscated malware with subtle changes may escape detection
Solution Approach 1:
The detection system divides malware detection into multiple segments by establishing separate baseline thresholds for different opcode categories (e.g., jump instructions, data movement, arithmetic operations). This segmentation allows the system to apply different sensitivity levels to different instruction types, improving overall detection coverage while maintaining precision through category-specific thresholds rather than a single blanket threshold
Data Source
AI summary
A computer program includes a plurality of different types of computer program instructions. Prior to execution of the computer program, the computer the computer program instructions of each of the types. At a time during execution of the computer program, the computer counts the computer program instructions of each of the types. The computer, in response to determining that the count for one of the instruction types determined prior to execution of the computer program differs by at least an associated threshold value from the count for the same instruction type determined during execution, makes a record that the computer program has an indicia of maliciousness.