Multi-Path Code Execution for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques struggle to effectively detect and prevent malware, particularly in computer-executable code, as some forms of malware remain difficult to detect despite attempts to inspect and prevent infections.
Innovation Solution
The implementation of techniques that allow executable code to execute multiple execution paths based on variable values, enabling the detection of malware and other attributes by analyzing different outputs produced, using symbolic representations and concrete values to condition the execution of code, thereby facilitating malware detection and error analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional code inspection techniques are used to detect malware, then the detection process is simple and fast, but the detection precision is insufficient and some malware forms remain undetected
Solution Approach 1:
The patent segments the code analysis process into multiple independent execution paths, each representing a different possible flow through the code. By dividing the analysis into separate paths based on conditional branches, the system can examine each path independently for malware indicators, thereby improving detection precision without overwhelming the analysis system with all possible combinations at once.
Solution Approach 2:
The patent adds a dimensional aspect to code analysis by executing code along multiple parallel paths simultaneously rather than following a single linear execution flow. This multi-dimensional approach allows the system to examine the same code from different execution perspectives, increasing the likelihood of detecting malware that might be hidden in specific execution paths while maintaining manageable complexity through systematic path exploration.
2Reliability
If multiple execution paths are executed to improve malware detection, then the detection capability is enhanced, but the execution time and computational resources increase
Solution Approach 1:
The patent applies preliminary action by identifying and marking suspicious code segments and potential malware indicators before executing multiple paths. By pre-processing the code to highlight areas of concern and establishing baseline expectations for normal execution, the system can then efficiently compare actual multi-path execution results against these pre-established criteria, improving detection reliability while reducing the time spent analyzing each individual path.
Solution Approach 2:
The patent implements skipping by allowing the execution engine to rapidly traverse through execution paths that have been determined to be safe or normal, focusing computational resources primarily on paths that exhibit suspicious behavior or deviate from expected execution patterns. This approach enables the system to maintain high detection reliability by thoroughly examining critical paths while minimizing time expenditure on obviously benign code sections.
Data Source
AI summary
Techniques for execution of multiple execution paths are described. In one or more embodiments, an execution of a portion of executable code is conditioned upon a particular environment-specific value. For example, the execution of the executable code can cause one type of output if the value of the variable equals a particular value, and can cause a different type of output if the value of the variable equals a different value. Techniques discussed herein can enable the executable code to be executed such that multiple outputs are produced, e.g., by executing the code according to the different values for the variable. In implementations, the multiple outputs can be analyzed for various attributes, such as presence of malware, implementation and coding errors, and so on.