Malware Classification via Runtime Event Sequence Clustering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional automatic malware classification systems fail to recognize subtle differences in code flow and data variations within malware families, limiting their ability to detect common behavior patterns across malware variants and compilers.

Innovation Solution

A computer-implemented method and system that classify applications into groups based on behavior patterns by collecting event sequences during application execution, calculating similarity distances, and updating application groups in a knowledge base, allowing for the detection of new malware families and variants.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If static analysis is used to detect malware, then detection speed is improved, but detection precision deteriorates because subtle differences in code flow and data variations are not detected

Engineering Contradiction:

Improvedetection speedVSAvoiddetection precision

Core Design Contradiction:

SpeedVSMeasurement precision

Solution Approach 1:

The patent transitions from static analysis to dynamic analysis by executing the application in a controlled environment and collecting runtime event sequences. This dynamic approach captures actual behavior patterns including code flow and data variations, thereby improving detection precision while maintaining automated processing speed.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent replaces traditional static code analysis mechanisms with a dynamic execution-based measurement system. By substituting mechanical code inspection with runtime behavior observation, the system achieves both speed (through automated execution) and precision (through actual behavior capture).

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Productivity

If conventional automatic malware classification is used, then classification speed is improved, but reliability deteriorates because common behavior patterns across malware variants are not recognized

Engineering Contradiction:

Improveclassification speedVSAvoidclassification reliability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements a feedback mechanism where event sequences collected from application execution are analyzed to identify behavior patterns. The system compares these patterns against known malware families and provides feedback for classification, improving reliability by capturing common behavior patterns across variants while maintaining automated classification speed.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent performs preliminary execution of the application in a controlled environment to collect event sequences before final classification. This preliminary action captures runtime behavior patterns that are characteristic of malware families, enabling more reliable classification while maintaining overall process efficiency.

Inventive Principle:

Principle #10Preliminary action

3Device complexity

If static code analysis is used, then device complexity is reduced, but measurement precision deteriorates because runtime behavior patterns cannot be captured

Engineering Contradiction:

Improvesystem complexityVSAvoidbehavior pattern detection precision

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The patent introduces an intermediary controlled execution environment that mediates between the application under test and the analysis system. This intermediary captures runtime event sequences without requiring complex modifications to the application, achieving behavior pattern detection precision while managing system complexity through a standardized interface.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS7809670B2Classification of malware using clustering that orders events in accordance with the time of occurance

Publication Date: 2010.10.05 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

The present invention is directed to a method and system for automatically classifying an application into an application group which is previously classified in a knowledge base. More specifically, a runtime behavior of an application is captured as a series of events which are monitored and recorded during the execution of the application. The series of events are analyzed to find a proper application group which shares common runtime behavior patterns with the application. The knowledge base of application groups is previously constructed based on a large number of sample applications. The construction of the knowledge base is done in such a manner that each sample application can be classified into application groups based on a set of classification rules in the knowledge base. The set of classification rules are applied to a new application in order to classify the new application into one of the application groups.