Obfuscatory Pestware Detection via Fixed Procedure Address Offsets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-pestware software struggles to detect polymorphic and metamorphic obfuscated malware due to the heavy processing burden of exhaustive memory scans, rendering it inefficient in identifying pestware that employs these obfuscation techniques.
Innovation Solution
A method and system that identify a reference to a known procedure with a fixed address in memory and search for a predetermined check value at a known offset, allowing for targeted detection of obfuscatory pestware without exhaustive scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory is scanned exhaustively for pestware signatures, then detection capability against obfuscated malware is improved, but system performance and operational efficiency deteriorate
Solution Approach 1:
The patent extracts and utilizes only the critical, immutable elements of malware (fixed procedure addresses and their associated check values) rather than analyzing the entire malware code. This selective extraction enables detection of obfuscated malware without requiring exhaustive memory scanning, thus maintaining detection capability while preserving system performance.
Solution Approach 2:
The patent performs preliminary analysis offline to identify fixed procedure addresses and their associated check values in known malware samples. This pre-computed information is then used during runtime detection, eliminating the need for exhaustive real-time analysis and enabling fast detection of obfuscated malware without impacting system performance.
2Productivity
If traditional signature-based detection is used, then processing overhead is reduced, but detection effectiveness against polymorphic and metamorphic malware deteriorates
Solution Approach 1:
The patent applies local quality by focusing detection efforts on specific, localized features of malware (fixed procedure addresses and their associated check values) rather than attempting to analyze the entire malware code. This localized approach maintains low processing overhead while improving detection effectiveness against obfuscated malware that changes its overall code structure.
Solution Approach 2:
The patent changes the detection parameters from traditional signature matching to detecting fixed procedure addresses and their associated check values. These parameters remain constant even when malware undergoes polymorphic or metamorphic transformations, enabling effective detection with minimal processing overhead.
3Measurement precision
If exhaustive memory scanning is performed to detect obfuscated pestware, then detection precision is improved, but detection speed and operational efficiency worsen
Solution Approach 1:
The patent extracts only the essential, immutable characteristics of malware (fixed procedure addresses and check values) for detection purposes. This selective extraction achieves high detection precision against obfuscated malware without requiring time-consuming exhaustive memory scanning, thus maintaining detection speed.
Solution Approach 2:
The patent performs preliminary identification of fixed procedure addresses and check values offline before runtime detection. This pre-computation enables fast, precise detection of obfuscated malware during execution without requiring exhaustive real-time memory scanning, thereby preserving detection speed.
Data Source
AI summary
A method and system for detecting obfuscatory pestware in a computer memory is described. One illustrative embodiment identifies, within an executable object, a reference to a known procedure, the known procedure having a fixed address in the computer memory; and searches for a predetermined check value at a known offset relative to an address, in the computer memory, of the reference to the known procedure.