Non-PE File Inspection via Breakpoint Execution Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods are inadequate in detecting malicious shell code within non-Portable Executable (non-PE) files, particularly in preventing Advanced Persistent Threat (APT) attacks that utilize Zero-day exploits, as they require extensive time and effort and are ineffective against variant malware, especially since most malware detection systems focus on executable files.
Innovation Solution
An apparatus and method that utilize Relative Virtual Address (RVA) information to determine if a non-PE file contains malicious shell code by setting up breakpoints and checking if the execution address falls within a normal address range, extracting and analyzing malicious code, and comparing it with vulnerability information to identify and defend against APT attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional malware detection systems focus on executable files (PE files), then detection capability for traditional malware is improved, but detection capability for malicious shell code in non-PE files deteriorates
Solution Approach 1:
The inspection apparatus is designed to handle both PE files and non-PE files (such as Office documents, images, and other formats) through a unified analysis framework. The system extracts candidate malicious address information from various file types and uses the same breakpoint-based detection mechanism, making the detection system universal across different file formats while maintaining high detection precision for malicious shell code.
2Measurement precision
If experts manually examine non-PE files to detect malicious code, then detection accuracy is improved, but inspection time and effort increase substantially
Solution Approach 1:
The system performs automatic inspection of non-PE files by loading them into a simulated runtime environment, setting breakpoints at candidate malicious addresses, and automatically analyzing execution flow. This self-service automation eliminates the need for manual expert examination while maintaining high detection accuracy, significantly reducing inspection time from hours of manual analysis to rapid automated detection.
Solution Approach 2:
The patent replaces manual expert analysis (mechanical human effort) with an automated computational system that uses program linking, breakpoint setting, and execution flow analysis. This substitution transforms the inspection process from labor-intensive manual examination to efficient automated detection, maintaining accuracy while dramatically reducing time loss.
3Reliability
If conventional techniques are used to detect variant malware in non-PE files, then some detection capability is maintained, but effectiveness against newly created variant malware deteriorates
Solution Approach 1:
The system performs preliminary analysis by extracting candidate malicious address information from non-PE files before actual execution occurs. By identifying potential malicious addresses in advance and setting breakpoints at these locations, the system is prepared to detect variant malware as soon as it attempts execution, enabling early detection of newly created variants before they can cause damage.
Solution Approach 2:
The inspection system uses feedback from breakpoint triggers to dynamically analyze execution flow and determine whether malicious code is present. When execution reaches a candidate malicious address, the system provides feedback about the suspicious activity and continues analysis to confirm malicious intent, creating an adaptive detection loop that remains effective against variant malware.
Data Source
AI summary
An apparatus for inspecting a non-PE file includes a data loading unit configured to load candidate malicious address information related to a malicious code of the non-PE file; and a program link unit configured to acquire normal address range information of a module being loaded on a memory when an application program adapted for the non-PE file is executed and set up a candidate malicious address corresponding to the candidate malicious address information to be a breakpoint of the application program. Further, the apparatus includes a malicious code determination unit configured to determine whether a next execution address is within the normal address range information when there occurs an event derived from the breakpoint.