Malware Detection via Static Invocation Path Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods face challenges in identifying obfuscated malware variants due to the rapid evolution of malware and the inability to keep pace with signature-based detection mechanisms, leading to inefficiencies in security software.
Innovation Solution
The implementation of static analysis systems and methods that identify malware by detecting exploitable method invocations within executable files, analyzing invocation paths, and matching predetermined parameters, allowing for accurate classification and generation of malware signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based malware detection mechanisms are used, then detection of known malware is effective, but detection of obfuscated malware variants fails due to inability to keep pace with rapidly evolving malware
Solution Approach 1:
The patent changes the detection parameters from signature-based patterns to contextual invocation patterns. Instead of detecting malware based on fixed signatures that malware authors can easily bypass, the system detects based on the contextual parameters of method invocations (preceding methods, invocation paths, parameter values), which remain consistent across obfuscated variants and provide reliable detection while adapting to new malware forms.
2Object-affected harmful factors
If malware authors apply obfuscation techniques to generate variants, then evasion of detection is achieved, but the proliferation of variants increases the burden on security software companies
Solution Approach 1:
The patent uses copying by creating a template-based detection model that captures the essential invocation pattern structure. Instead of manually analyzing each malware variant to create new signatures, the system copies the detection logic from one identified pattern to detect multiple variants, significantly reducing the workload while maintaining detection effectiveness across obfuscated versions.
3Measurement precision
If static analysis with contextual method invocation detection is implemented, then detection accuracy for obfuscated malware improves, but system complexity increases due to analysis of invocation paths and parameters
Solution Approach 1:
The patent extracts only the essential elements needed for detection: the contextual method invocation patterns, invocation paths, and key parameter values. By taking out and focusing on these specific critical elements rather than analyzing entire program behaviors, the system achieves high detection precision while keeping the analysis complexity manageable through targeted extraction of relevant features.
Data Source
AI summary
The disclosed computer-implemented method for detecting malware using static analysis may include (i) identifying an executable file to subject to analysis for malware, (ii) retrieving an association between a known malicious behavior and an exploitable method being invoked, wherein the association specifies that a contextual method precedes the exploitable method in an invocation path and that the exploitable method is invoked with a set of predetermined parameters, (iii) detecting, within the executable file, an invocation of the exploitable method, (iv) determining that the invocation of the exploitable method within the executable file occurs in a detected invocation path in which the contextual method precedes the exploitable method and that the invocation of the exploitable method includes a set of invoking parameters that matches the set of predetermined parameters, and (v) classifying the executable file as containing malware. Various other methods, systems, and computer-readable media are also disclosed.