Pestware Detection via Code Graph Function Call Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current pestware detection systems are not sufficiently accurate and struggle to detect obfuscated or polymorphic malware, as they rely on recognizing specific commands rather than analyzing function calls and their sequences, making it difficult to identify minor variations or disguised pestware.
Innovation Solution
The system generates and uses code-graph-based definitions that capture the occurrence and relative locations of function calls, creating a graph representation to compare suspect files against, allowing for detection of pestware even with minor alterations, by focusing on the functionality and sequences of system calls rather than specific commands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional pestware detection systems use specific command recognition techniques, then they can identify known pestware variants, but they fail to detect obfuscated or polymorphic malware with minor variations
Solution Approach 1:
The system changes the detection parameters from recognizing specific command instructions to analyzing function call sequences and their relative locations. By transforming the detection focus from command-based parameters to sequence-based parameters, the system can identify pestware regardless of obfuscation or polymorphic variations in the actual commands used.
Solution Approach 2:
The system introduces an intermediary representation layer - the code-graph-based definition that captures function call sequences and relative locations. This intermediary abstraction serves as a bridge between the raw pestware code and the detection mechanism, allowing identification of pestware patterns without being affected by command-level obfuscation or variation.
2Object-affected harmful factors
If pestware is obfuscated with encryption or made polymorphic, then it becomes harder to recognize, but traditional detection systems still rely on recognizable command patterns
Solution Approach 1:
Instead of trying to recognize pestware commands directly (the traditional approach), the system inverts the approach by analyzing the sequence patterns and relative locations of function calls. This inversion allows detection to work regardless of how the commands are obfuscated or encrypted, as the sequence structure remains detectable even when individual commands are hidden or transformed.
3Device complexity
If detection systems focus on specific commands, then they are simpler to implement, but they cannot detect minor variations or disguised pestware
Solution Approach 1:
The system segments the pestware detection task into analyzing individual function calls and their sequences rather than attempting to recognize complete command patterns. By breaking down the detection into smaller units (function calls) and their relationships (sequences and relative locations), the system achieves higher accuracy while maintaining manageable complexity through systematic analysis of discrete components.
Data Source
AI summary
A system and method for defining and detecting pestware is described. One embodiment includes receiving a file and placing at least a portion of the file into a processor-readable memory of a computer. A plurality of execution paths within code of the pestware file are followed and particular instructions within the execution paths are identified. A representation of the relative locations of each of the particular instructions within the code of the file are compared against a pestware-definition file so as to determine whether the file is a potential pestware file.