Parallel LLM Malware Analysis for Obfuscation Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware authors are increasingly using sophisticated obfuscation techniques to hinder analysis by security analysts and systems, making it difficult for traditional static analysis and rules-based matching techniques to identify obfuscated malware code.
Innovation Solution
A dynamic malware execution and emulation (DMEE) module extracts and records CPU instructions, register states, call-trees, and memory states, combined with parallel large language models (LLMs) and generative AI to identify anomalous code branches and function calls indicative of obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional static analysis and rules-based matching techniques are used to detect malware, then the detection process is simple and fast, but the detection accuracy deteriorates when malware code is obfuscated
Solution Approach 1:
The patent replaces traditional mechanical/static analysis methods with dynamic execution and emulation systems that actively run malware in controlled environments, allowing detection of obfuscated code through behavioral analysis rather than static pattern matching
Solution Approach 2:
The patent introduces parallel LLMs and generative AI modules as intermediary components between the malware sample and the detection system, which analyze de-obfuscated code and identify obfuscation techniques by comparing against known patterns and generating intelligence reports
2Reliability
If malware code is obfuscated to protect intellectual property, then the code protection is improved, but the detectability by security systems deteriorates
Solution Approach 1:
The patent converts the harmful effect of obfuscation (hiding malware functionality) into a beneficial detection signal by identifying specific obfuscation patterns and techniques, allowing security systems to recognize and flag obfuscated malware while understanding its true intent through dynamic analysis
Solution Approach 2:
The patent employs dynamic malware execution and emulation that adapts to different obfuscation techniques in real-time, allowing the system to dynamically adjust analysis strategies based on the detected obfuscation methods rather than relying on fixed static analysis rules
3Measurement precision
If dynamic analysis is performed to identify obfuscation techniques, then the detection capability is improved, but the analysis time and computational resources increase
Solution Approach 1:
The patent segments the analysis process into parallel independent streams using multiple LLMs that simultaneously analyze different aspects of the malware behavior, reducing overall analysis time by distributing the computational workload across multiple processing units rather than sequential analysis
Solution Approach 2:
The patent performs preliminary de-obfuscation and code reconstruction during the dynamic execution phase itself, rather than requiring separate post-analysis steps, allowing the system to prepare cleaned code versions in advance for faster subsequent analysis by the LLMs
Data Source
AI summary
In a computer-implemented method, malicious software samples are received from a central malware repository by a dynamic malware execution and emulation (DMEE) module and from a queuing and routing module. Using the DMEE module, a malicious software sample is emulated. Using the DMEE module and as extracted features, relevant binary data associated with the malicious software sample is extracted. The malicious software sample is disassembled and decompiled to obtain collection feature sets. The extracted features and the collection feature sets are forwarded to an array of parallel large language models (LLMs) and generative artificial intelligence (AI) modules. Using the array of parallel LLMs and generative AI modules, data indicating potential use of obfuscation techniques is determined. The data indicating potential use of obfuscation techniques is reported by the DMEE using a reporting module.