Malware Translation Engine for Polymorphic Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus software is ineffective against obscured malware, such as polymorphic malware, which evades detection by changing encryption routines and lacking identifiable signatures, leading to unchecked propagation in networks until software updates.
Innovation Solution
A security model that translates potential malware into safe program code by analyzing and decoding instructions at entry points in memory, identifying and reporting malware, and translating basic blocks into architecture-neutral formats for execution, ensuring detection and prevention of malware execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software uses signature-based detection, then known malware can be identified and removed, but obscured malware with changing encryption routines cannot be detected
Solution Approach 1:
The patent translates potential malware into safe program code before execution, performing the translation action in advance. This preliminary translation allows the malware to be analyzed in a controlled environment where its behavior can be observed and detected without actually executing the harmful code, thus resolving the contradiction between detecting known malware reliably and adapting to detect obscured malware.
Solution Approach 2:
The patent introduces an intermediary translation layer that converts malware from its original encrypted or obscured form into a safe, analyzable format. This intermediary translation process allows antivirus software to examine the malware's behavior and characteristics without being blocked by encryption routines, enabling detection of both known and obscured malware variants.
2Device complexity
If antivirus software waits for updates to identify new malware, then software complexity remains low, but malware propagation remains unchecked
Solution Approach 1:
The system performs preliminary translation of potential malware before it can execute or propagate. By translating the code into a safe format in advance, the system can analyze and detect new malware variants immediately upon encounter, without needing to wait for signature database updates, thus improving protection reliability while maintaining manageable complexity.
Solution Approach 2:
The translation mechanism enables the antivirus system to autonomously analyze and detect malware on-the-fly without requiring external updates or manual intervention. The system serves itself by translating and analyzing potential threats in real-time, allowing immediate detection of new malware variants while keeping the software architecture relatively simple.
3Object-affected harmful factors
If malware encryption routines are changed to obscure signatures, then detection by conventional antivirus becomes difficult, but translation into safe code reveals the malware behavior
Solution Approach 1:
The translation process acts as an intermediary that bridges the gap between obscured malware and detection capabilities. By translating the encrypted or polymorphic malware into safe program code, the system reveals the underlying behavior and characteristics of the malware, making it detectable despite the obscuration techniques used, thus resolving the contradiction between malware hiding capabilities and detection reliability.
Data Source
AI summary
The present invention includes a system and method for translating potential malware devices into safe program code. The potential malware is translated from any one of a number of different types of source languages, including, but not limited to, native CPU program code, platform independent .NET byte code, scripting program code, and the like. Then the translated program code is compiled into program code that may be understood and executed by the native CPU. Before and/or during execution, the present invention causes a scanner to search for potential malware stored in memory. If malware is not detected, the computing device causes the CPU to execute the translated program code. However, execution and/or analysis of potential malware may be interrupted if computer memory that stores potential malware is altered during execution. In this instance, the potential malware now stored in memory is translated into safe program code before being executed.