PE Malware Detection Using P-Code Backward Slicing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods for portable executable (PE) files are inefficient, requiring manual analysis and deep technical expertise, and existing automated methods lack accuracy and resource efficiency.
Innovation Solution
A system and method for malware detection using backward program slicing with P-code emulation, involving decompiling PE files into P-code, extracting predetermined variables, tracking them backward to their sources, and determining malicious indicators through constant values and API calls, with database matching for pattern recognition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual analysis is used to verify PE files for malicious activities, then detection accuracy is improved, but time consumption and resource requirements increase significantly
Solution Approach 1:
The patent introduces an intermediary automated analysis system that acts as a mediator between manual analysis and simple signature matching. This system uses decompilation, data flow analysis, and variable tracking to automatically detect malicious activities with high accuracy, eliminating the need for time-consuming manual analysis while maintaining detection precision.
Solution Approach 2:
The patent replaces the mechanical manual analysis process with an automated computational system. The system uses computer-based decompilation, data flow analysis, and variable tracking to perform malware detection automatically, substituting human experts' manual work with automated mechanical processes that are both accurate and efficient.
2Use of energy by moving object
If simple signature matching methods are used for malware detection, then resource consumption is reduced, but detection accuracy decreases
Solution Approach 1:
The patent extracts only the critical and relevant variables from the decompiled PE file that are potentially malicious, rather than analyzing the entire file or using resource-intensive comprehensive analysis. This selective extraction of suspicious variables enables efficient resource usage while maintaining high detection accuracy through focused analysis of malicious indicators.
3Reliability
If sandbox analysis is used for malware detection, then detection capability is improved, but resource requirements and processing time increase
Solution Approach 1:
The patent extracts and analyzes only the essential variables and data flow paths that indicate malicious behavior, rather than performing comprehensive sandbox analysis that requires extensive resources. This selective approach maintains detection capability by focusing on critical malicious indicators while significantly reducing resource requirements.
4Productivity
If automated analysis systems are implemented for PE files, then productivity increases, but system complexity increases
Solution Approach 1:
The patent segments the malware detection process into distinct modular stages: decompilation, data flow analysis, variable extraction, and malicious activity detection. Each stage handles a specific aspect of the analysis, which improves processing throughput through efficient pipeline execution while managing system complexity by organizing functions into separate, manageable modules.
Data Source
AI summary
Systems and methods for detecting malware in portable executable (PE) files is provided. A PE file can be received by a server, the PE file can be decompiled into p-code, and one or more predetermined variables can be extracted from the p-code, where the one or more predetermined variables are potentially malicious. The one or more predetermined variables can be backward to its respective source and constant values found in the one or more predetermined variables can be extracted. The constant values can indicate the PE file as malware and preventing the PE file from being executed.