.NET Application Categorization via CLR Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting and categorizing malicious .NET applications are ineffective due to the difficulty in distinguishing between relevant and irrelevant system function calls, leading to inaccurate analysis.
Innovation Solution
Implementing a CLR profiler to create an execution log of .NET applications, which includes byte representations of data in RAM, and using heuristic rules to categorize applications as trusted, untrusted, or malicious based on specific event sequences and assembly loading, with actions such as quarantine or termination for malicious applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If system function call logs are analyzed to detect malicious .NET applications, then detection capability is provided, but accuracy deteriorates due to extraneous information from CLR internal processes
Solution Approach 1:
The patent segments the system function calls into two distinct categories: those originating from CIL code (application execution logic) and those from CLR internal processes. By separating these sources, the system can filter out extraneous CLR-related calls and focus analysis only on the relevant application behavior, thereby resolving the contradiction between maintaining detection capability and improving detection accuracy.
2Loss of information
If CLR profiler is used to capture execution events, then information completeness is improved, but data volume and processing complexity increase
Solution Approach 1:
The patent extracts and isolates the essential execution events from the comprehensive profiler output. Instead of processing all captured data, the system selectively extracts events related to assembly loading, module execution, and specific API calls that are indicative of malicious behavior. This extraction approach maintains information completeness for relevant events while reducing overall processing complexity.
3Reliability
If comprehensive execution logging is implemented, then analysis completeness is improved, but processing time and resource consumption increase
Solution Approach 1:
The patent implements partial logging by focusing only on specific event types and execution paths that are most relevant to detecting malicious .NET applications. Rather than logging all execution events comprehensively, the system selectively monitors assembly loads, module executions, and suspicious API calls, achieving sufficient analysis completeness while significantly reducing processing time and resource consumption.
Data Source
AI summary
Disclosed herein are systems and methods of categorizing a .NET application. In one aspect, an exemplary method comprises, by a hardware processor of a security module, launching a CLR profiler upon launching of the .NET application, forming an execution log of the .NET application and adding information about events occurring during the execution of the .NET application via the launched CLR profiler, assigning to the .NET application, a category of a predetermined list of categories based on an analysis of the execution log of the .NET application, and determining whether the .NET application is categorized as being a malicious application.