MSIL Wildcard Hashing for .NET Malware Family Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors use sophisticated techniques to obfuscate their software, making it difficult for existing security systems to detect and prevent malware from compromising computers and communicating with command and control servers.
Innovation Solution
Transform the Microsoft Intermediate Language (MSIL) code of .NET binaries into a uniform format, generate a file signature (DNCodeHash) by hashing the wildcarded methods, and use this signature for malware detection and clustering, which improves accuracy and reduces false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection methods are used, then detection capability is maintained, but accuracy is low due to obfuscation techniques
Solution Approach 1:
The patent transforms MSIL code by changing its parameter representation - replacing method parameters with wildcard characters (*) to create a normalized format that is independent of specific parameter names and types. This transformation enables accurate matching of obfuscated malware while maintaining manageable analysis complexity through systematic parameter abstraction.
Solution Approach 2:
The patent applies different processing treatments to different parts of the code structure - method signatures are wildcarded while method bodies are hashed. This local differentiation allows the system to capture structural patterns at the signature level while handling the complexity of implementation details through hashing, thereby improving detection accuracy without proportionally increasing analysis complexity.
2Object-affected harmful factors
If code obfuscation is used by malware authors, then malware evasion capability is improved, but detection accuracy deteriorates
Solution Approach 1:
Instead of trying to detect obfuscated malware through its original form, the patent inverts the approach by transforming the code into a normalized wildcard format where obfuscation details are abstracted away. This inversion allows the detection system to see through obfuscation layers and identify the underlying malicious patterns that remain consistent despite parameter name changes.
Solution Approach 2:
The patent creates a transformed copy of the MSIL code with wildcarded parameters that preserves the structural essence while removing obfuscation-specific details. This copied representation serves as the basis for detection, allowing the system to identify malware families based on their structural patterns rather than surface-level obfuscation variations.
3Measurement precision
If detailed code analysis is performed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent extracts only the essential structural information from MSIL code - specifically method signatures with wildcarded parameters - while excluding detailed implementation content which is replaced with hashes. This extraction approach maintains detection accuracy by preserving structural patterns while reducing processing time by eliminating the need to analyze every detail of method bodies.
Solution Approach 2:
The patent segments the code analysis into distinct components: method signature analysis through wildcarding and method body analysis through hashing. This segmentation allows the system to process different parts of the code with appropriate techniques, improving overall efficiency while maintaining comprehensive detection capability.
Data Source
AI summary
Various embodiments provide a system, method, and device for generating a signature for Windows .NET binaries. The method incudes (i) generate a file signature based on code using a hashing technique, and (ii) classify a sample using the file signature based on the code.