Malware Trigger Scenario Detection System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as signature and hash sum analysis, fail to detect modified or obfuscated malware, and behavioral analysis can be ineffective and resource-intensive, as they require triggering malicious software, potentially allowing harm to occur before detection.
Innovation Solution
The system employs behavioral malware analysis using malware trigger scenarios, which specify sets of events known to trigger malicious behavior, allowing for monitoring and analysis of software execution events across multiple levels of a computer system, including application, OS, and hardware, to determine and remediate malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavioral analysis is used to detect modified malware, then detection effectiveness is improved, but system productivity deteriorates due to resource-intensive execution monitoring
Solution Approach 1:
The system performs preliminary static analysis of malware samples to identify suspicious code patterns, APIs, and behaviors before execution. This preliminary characterization allows the system to focus behavioral monitoring only on suspicious samples and specific trigger events, reducing overall resource consumption while maintaining detection effectiveness
Solution Approach 2:
Instead of monitoring all possible behavioral aspects of malware execution, the system implements selective monitoring focused on specific trigger events and suspicious behaviors identified through static analysis. This partial monitoring approach reduces resource overhead while maintaining adequate detection capability
2Reliability
If traditional behavioral analysis is used to detect malware, then modified malware can be detected, but harmful effects occur before detection since triggering is required
Solution Approach 1:
The system performs static analysis and creates a behavioral profile of the malware sample before execution. This preliminary analysis identifies suspicious patterns and potential harmful behaviors, allowing the system to prepare countermeasures and isolate the malware before it can execute harmful actions
Solution Approach 2:
The system introduces a controlled execution environment with sandboxing and virtualization technologies. This intermediary layer allows malware to be executed and monitored in isolation, preventing direct harm to the host system while still enabling behavioral analysis
3Measurement precision
If signature and hash sum analysis are used, then known malware is detected accurately, but modified and obfuscated malware cannot be detected
Solution Approach 1:
The system segments malware analysis into multiple independent components: static analysis (examining code structure, APIs, and patterns), dynamic analysis (monitoring execution behavior), and hybrid analysis (combining both approaches). This segmentation allows each component to specialize in detecting different types of malware characteristics
Solution Approach 2:
The system changes the analysis parameters from fixed signatures and hash values to dynamic behavioral parameters such as API call sequences, system call patterns, and execution flow characteristics. These parameter changes enable detection of malware based on behavior rather than exact code matching, improving detection of modified and obfuscated samples
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Disclosed are systems and methods for detecting malware by performing behavioral malware analysis using malware trigger scenarios. In one aspect, a method for malware detection includes providing a plurality of malware trigger scenarios specifying different sets of malware trigger events known to trigger malicious behaviour in malicious software. The method further includes executing a software program in a computer environment and creating one more malware trigger events as specified in the malware trigger scenarios. The method further includes monitoring execution events of the software program in the computer environment and determining based on the analysis of the monitored execution events whether the software program exhibits malicious behaviour. When the software program exhibits malicious behaviour, the method includes performing remedial actions on the software program. When the software program does not exhibit malicious behaviour, the method includes selecting another scenario from the plurality of malware trigger scenarios for malware testing of the software program.