Malware Signature Generation via Virtual Machine State Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods face challenges in identifying obfuscated malware embedded in HTML and PDF files, particularly in JavaScript code, as they struggle to efficiently and safely execute and analyze such files to generate effective detection signatures.
Innovation Solution
The implementation of an execution environment that safely runs target software from HTML and PDF files, utilizing a virtual machine to identify specific regions of code as malware detection signature candidates by mapping virtual machine states to abstract syntax data structures and searching for terminated assignments, thereby isolating relevant code for further investigation and signature generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware is embedded in HTML and PDF files with obfuscated JavaScript code, then malware detection capability is improved, but code analysis complexity increases
Solution Approach 1:
The patent segments the code analysis process into distinct phases: parsing HTML/PDF files, extracting JavaScript code, executing code in a sandboxed virtual machine environment, and analyzing execution traces. This segmentation allows complex obfuscated code to be processed systematically through controlled stages, reducing overall analysis complexity while maintaining detection reliability.
Solution Approach 2:
The patent introduces a virtual machine execution environment as an intermediary between the static obfuscated code and the analysis system. This intermediary executes the JavaScript code in a controlled sandbox, generating execution traces and variable state information that are much easier to analyze than the original obfuscated code, thus reducing code analysis complexity while improving detection capability.
2Reliability
If entire software code is analyzed for malware, then detection thoroughness is improved, but analysis time increases
Solution Approach 1:
The patent extracts only the relevant portions of code for analysis by identifying and isolating JavaScript code blocks within HTML and PDF files. Rather than analyzing entire software programs, the system extracts specifically the embedded code segments that are likely to contain malware, significantly reducing analysis time while maintaining detection thoroughness for the targeted code regions.
Solution Approach 2:
The patent performs preliminary parsing and extraction of JavaScript code from HTML and PDF files before execution analysis. This preliminary action identifies and isolates potential malware code regions in advance, allowing the subsequent execution and analysis phases to focus only on relevant code segments, thereby reducing overall analysis time while maintaining thoroughness.
3Measurement precision
If code execution is performed to detect malware, then detection accuracy is improved, but safety risks increase
Solution Approach 1:
The patent employs a virtual machine execution environment as a safe intermediary that isolates the code execution from the host system. This sandboxed environment allows malware code to be executed for analysis purposes while containing any potential harmful effects within the virtual machine boundary, thus improving detection accuracy through actual code execution while eliminating safety risks to the host system.
Solution Approach 2:
The patent creates an inert, isolated execution environment using virtualization technology. This virtual machine sandbox acts as a protective barrier that prevents malware from affecting the host system while still allowing code execution to occur. The inert environment contains all potential harmful effects within the virtual machine, enabling safe malware detection through execution analysis.
Data Source
AI summary
A region of HTML or PDF file bytecode run on a virtual machine is identified as possible malware, allowing a detection signature to be generated. A determination is made, based on code behavior, that malware may be present. Variables visible in this identification start state can be found by mapping the start state to scopes in an abstract syntax data structure. Searching previously executed states of the virtual machine for any assignment of a variable that belongs to the set of variables of interest provides a set of assignments of interest, even in obfuscated code. Nonterminated assignments of interest will lead in turn to other variables of interest and assignments of interest, until all assignments of interest are terminated. At that point, a region of code defined by the assignments of interest is identified as a malware detection signature generation candidate, and submitted to a human or automated analyst.