Memory Dump Scanning for Packed Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security software struggles to detect packed malicious software, as packers can evade detection by modifying the executable file, leading to inefficiencies in signature scanning and emulation techniques.
Innovation Solution
A client security module analyzes the executable file image created during process execution, performs a memory dump, and modifies it to resemble a normal file, allowing for effective signature scanning for malicious software signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature scanning is used to detect malicious software, then detection accuracy for unpacked malware is improved, but detection capability against packed malware deteriorates
Solution Approach 1:
The system performs preliminary actions by creating a memory dump of the process address space before signature scanning. This memory dump captures the unpacked state of packed malware that exists temporarily during execution, allowing signature scanning to detect malware that would otherwise be hidden in its packed form on disk.
Solution Approach 2:
The invention creates a copy of the process memory space (memory dump) to a file, which resembles an unpacked executable file. This copy can be scanned with signature scanning techniques without affecting the running process, enabling detection of packed malware in its vulnerable unpacked state.
2Measurement precision
If emulation is used to analyze packed software, then detection of hidden signatures is improved, but processing time increases significantly
Solution Approach 1:
The system performs preliminary action by capturing the memory dump while the process is already executing and unpacked. This eliminates the need for time-consuming emulation to unpack the malware, as the unpacking has already occurred naturally during normal process execution.
Solution Approach 2:
The invention skips the time-consuming emulation step by directly accessing the process memory space where packed malware has already been unpacked during execution. This allows rapid signature scanning without waiting for emulation to complete the unpacking process.
3Object-affected harmful factors
If packers are used to camouflage malicious software, then evasion of detection is improved, but vulnerability to memory analysis increases
Solution Approach 1:
The invention shifts the detection dimension from analyzing the packed file on disk to analyzing the process memory space where the malware exists in its unpacked form. This dimensional change from file system to memory space exploits the fact that packers must unpack malware to execute, creating a detectable state in memory.
Data Source
AI summary
An executable file containing malicious software can be packed using a packer to make the software difficult to detect. The executable file is loaded into the computer's memory and executed as a process. A memory dump module analyzes the address space for the process and identifies an executable file image within it. The memory dump module creates a memory dump file on the computer's storage device containing the file image and modifies the file to make it resemble a normal executable file. A signature scanning module scans the memory dump file for signatures of malicious software. If a signature is found in the file, a reporting module sends the host file for the process and the memory dump file to a security server for analysis.