Malware Code Subroutine Profiling for Variant Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection methods fail to detect minor variations in malware due to single bit changes, leading to missed detections, and existing granular signature generation techniques are undermined by malware adaptations.
Innovation Solution
The method involves disassembling executable code to identify logical subroutines and extracting features such as register usage, stack size, and memory access locations, generating a profile for comparison with received software components to detect malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to identify malware, then detection accuracy for known threats is improved, but the system cannot detect newly emerging malware variants and the constant updating of signature databases increases maintenance complexity
Solution Approach 1:
The patent replaces traditional signature-based detection (mechanical pattern matching) with a machine learning-based detection system. The system uses trained machine learning models to analyze code characteristics, control flow graphs, and behavioral patterns, enabling detection of both known and unknown malware variants without requiring constant signature updates.
Solution Approach 2:
The patent transforms the detection approach by changing from fixed signature parameters to dynamic feature parameters. The system extracts multiple features including code entropy, control flow complexity, and API call patterns, then uses machine learning to determine maliciousness based on parameter combinations rather than exact signature matches.
2Measurement precision
If comprehensive code analysis is performed to improve detection accuracy, then malware identification improves, but analysis time increases and processing speed decreases
Solution Approach 1:
The patent divides code analysis into multiple segments or stages. The system first performs static analysis on code structure and characteristics, then selectively applies more intensive dynamic analysis only to suspicious samples. This segmented approach maintains high detection accuracy while reducing overall processing time for benign code.
Solution Approach 2:
The patent applies partial analysis actions based on risk assessment. For low-risk code, minimal analysis is performed; for high-risk or suspicious code, comprehensive analysis is applied. This selective approach optimizes the balance between detection accuracy and processing speed by concentrating resources where most needed.
Data Source
Figure 1~2
Figure 3
AI summary
A computer implemented method of detecting malware in a received software component comprising: generating a profile for the malware by the steps of: a) accessing machine code for the malware; b) identifying a subset of the machine code for the malware as a logical subroutine of the malware; c) extracting one or more features of the logical subroutine of the malware as the profile, accessing machine code for the received software component to identify a plurality of logical subroutines thereof; extracting one or more features of each logical subroutine of the received software component for comparison with the profile to detect the malware in the received software component.