Malware Tagging and Tracking for C2 Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods struggle to identify command and control servers in malware communication due to obfuscation and encryption, especially when the command is for switching program code execution, leading to difficulties in detection.
Innovation Solution
An apparatus and method that tag and track data propagated by malware, using a monitoring unit to identify communication destination information of command and control servers based on branch instructions and data passing relationships, even when the command only specifies program code to be executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware communication content is obfuscated/encrypted, then communication security is improved, but command and control server identification becomes difficult
Solution Approach 1:
The patent introduces an intermediary approach by analyzing the data-passing relationship between system calls and received data, rather than directly analyzing the obfuscated communication content. This intermediary method traces how received data flows through system calls to identify command and control servers, effectively bypassing the obfuscation/encryption barrier while maintaining detection accuracy
Solution Approach 2:
The patent replaces the mechanical approach of directly analyzing communication content with a different mechanism - tracking data propagation through system calls and API arguments. This substitution allows identification of command and control servers based on data flow patterns rather than content analysis, overcoming the limitation imposed by obfuscation and encryption
2Ease of operation
If only program code to be executed is specified in commands, then command simplicity is improved, but detection capability deteriorates
Solution Approach 1:
The patent extracts the essential detection signal from the command structure by focusing on branch instructions that receive data from communication destinations. Even when commands are simplified to only specify program code, the data-passing relationship through system calls provides a detectable pattern, allowing identification of command and control servers without relying on complex command structures
Data Source
AI summary
A command and control server identifying apparatus provides data received by malware upon execution of the malware with a tag that allows to uniquely identify communication destination information of a source of the data, and tracks propagation of the data provided with the tag. Then, the command and control server identifying apparatus obtains a tag of data referred to by a branch instruction executed by the malware among tracked data. Then, the command and control server identifying apparatus identifies communication destination information of a command and control server that issues a command to the malware, based on communication destination information of a source associated with the obtained tag.