Obfuscated Malware Detection via Stack Pointer Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware protection programs face difficulties in detecting obfuscated malware code, as obfuscation techniques modify control flow and manipulate call instructions, making it challenging to identify and differentiate between obfuscated and non-obfuscated code.
Innovation Solution
The method involves identifying call instructions, storing default values, executing them to track return addresses, and determining if non-obfuscation signals are present, thereby distinguishing between obfuscated and non-obfuscated code by analyzing the stack pointer modifications and threshold analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If malware code is obfuscated using control flow graph obfuscation techniques, then the malware becomes harder to detect by protection programs, but the malware remains harmful to the system
Solution Approach 1:
Instead of trying to detect obfuscated malware directly, the patent inverts the approach by analyzing whether code exhibits characteristics of obfuscation. It detects patterns typical of Control Flow Graph obfuscation (such as abnormal jump instruction patterns and call instruction manipulations) to identify obfuscated code, thereby making the detection capability work against the obfuscation itself rather than trying to penetrate it directly
Solution Approach 2:
The patent changes the 'color' or perspective of detection by shifting from signature-based detection to behavior-based detection. It looks for specific behavioral patterns (such as abnormal control flow patterns, unusual stack pointer modifications, and suspicious call instruction sequences) that indicate obfuscation, effectively changing what characteristics are being monitored to identify malware
2Measurement precision
If malware protection programs use traditional signature-based detection methods, then known malware can be identified, but obfuscated malware evades detection
Solution Approach 1:
The patent changes the parameters being measured from static code signatures to dynamic execution characteristics. Instead of comparing against known malware signatures, it measures parameters such as control flow graph structure, jump instruction density, call instruction patterns, and stack pointer behavior to detect obfuscation, thereby adapting the detection parameters to work against obfuscated code
Solution Approach 2:
The patent introduces an intermediary analysis layer that examines control flow graphs and instruction patterns as mediators between the malware code and the detection system. This intermediary layer analyzes the structure and behavior of code without needing to understand or recognize specific malware signatures, allowing detection of obfuscated code through its structural characteristics rather than its functional content
3Difficulty of detecting and measuring
If control flow instructions are manipulated to obfuscate malware, then detection becomes more difficult, but the code execution control is modified
Solution Approach 1:
The patent employs feedback mechanisms by monitoring execution flow and comparing actual control transfer patterns against expected patterns. It uses stack pointer validation and return address verification to provide feedback on whether control flow manipulations are consistent with legitimate code or exhibit obfuscation characteristics, thereby maintaining reliability detection despite control flow modifications
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for obfuscated malware. In one aspect, a method includes executing from a binary executable a call instruction and a plurality of instruction subsequent to a target of the call instruction, determining if the value identified by the stack pointer of the call stack is equal to a default value stored in the call stack prior to emulation, determining if there is a non-obfuscation signal resulting from the execution of the call instructions and the plurality of instructions, and if the value identified by the stack pointer is the default value and there is no obfuscation signal,, identifying the call instruction as a possibly obfuscated call instruction. Additionally, the method includes determining that if the number of call instructions identified as possibly obfuscated call instructions exceeds a threshold number, identifying the binary executable as an obfuscated executable.