Malicious .NET File Detection via CLR Metadata Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious.NET files are inadequate due to the similarity in PE file structures between malicious and benign files, making it difficult to accurately distinguish between them.
Innovation Solution
A system and method that utilize a machine learning model to detect malicious.NET files by extracting features from CLR metadata and streams, and applying a classifier to determine the maliciousness of the files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional PE file structure analysis is used to detect malicious .NET files, then the detection method is simple and fast, but the detection accuracy is low because malicious and benign files have similar PE structures
Solution Approach 1:
The patent segments the .NET file analysis into two distinct parts: PE file structure analysis and CLR metadata analysis. While PE structure provides quick initial filtering, the patent specifically extracts CLR metadata (assembly information, module references, type definitions) to create a more granular and accurate fingerprint of the file's true identity and behavior, thereby resolving the contradiction between simple detection and accurate detection.
Solution Approach 2:
The patent transitions from analyzing only the PE file structure (one dimension) to analyzing both PE structure and CLR metadata (adding another dimension). This dimensional expansion allows the detection system to capture characteristics that are invisible in traditional PE analysis, significantly improving detection accuracy without completely abandoning the simplicity of PE-based methods.
2Reliability
If obfuscation techniques are used by malware authors to hide malicious behavior, then the malware becomes harder to detect, but existing detection methods become even less effective
Solution Approach 1:
The patent uses CLR metadata as an intermediary layer between the obfuscated malware code and the detection system. While malware authors can obfuscate the actual code logic, the CLR metadata (which contains information about assemblies, modules, types, and their relationships) remains structured and analyzable. This intermediary provides a stable foundation for detection that is less susceptible to obfuscation techniques.
Solution Approach 2:
The patent changes the detection parameters from high-level PE file characteristics to low-level CLR metadata characteristics. By focusing on parameters such as assembly version information, module reference patterns, type definition structures, and metadata table relationships, the detection system identifies subtle anomalies that persist even when the malware's surface-level behavior is obfuscated.
3Measurement precision
If machine learning models are applied to analyze CLR metadata for detecting malicious .NET files, then detection accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary extraction and structuring of CLR metadata before applying machine learning analysis. By pre-processing the metadata into standardized formats and extracting key features in advance, the system reduces the computational burden during the actual detection phase, thereby minimizing processing time while maintaining high accuracy.
Solution Approach 2:
The patent extracts only the most relevant CLR metadata fields needed for detection (such as assembly information, module references, and type definitions) rather than analyzing the entire metadata structure. This selective extraction reduces data volume and processing requirements, allowing machine learning models to operate more efficiently with less time and computational resources.
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting malicious .NET files. The method includes receiving a sample that comprises a .NET file, obtaining information pertaining to common language runtime (CLR) metadata and streams associated with the .NET file, and determining whether the sample is malware based at least in part on (i) a classifier, and (ii) the information pertaining to the CLR metadata and streams.