Pestware Detection via Function Parameter Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current pestware detection systems are not sufficiently accurate and are often unable to detect obfuscated or polymorphic malware, which can render them ineffective against certain types of malicious software.
Innovation Solution
A system and method that involves generating function-parameter-based definitions by analyzing pestware files, which captures the parameters and occurrences of function calls, and using these definitions to compare against suspect files on client devices, allowing for more effective detection of pestware regardless of minor variations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional pestware detection techniques are used, then detection speed is maintained, but detection accuracy deteriorates against obfuscated and polymorphic malware
Solution Approach 1:
The patent changes the detection parameters from static file characteristics (hash values, file signatures) to dynamic execution parameters (function call parameters, system call arguments, register values). This parameter transformation enables detection of polymorphic and obfuscated malware by capturing behavioral characteristics during execution rather than relying on static code analysis that can be easily obfuscated or modified.
Solution Approach 2:
The patent substitutes traditional mechanical code analysis methods with a virtualized execution environment that captures runtime behavior. Instead of directly analyzing potentially obfuscated code, the system creates a virtual execution context that safely executes the malware and records its operational parameters, replacing direct code inspection with indirect behavioral observation.
2Adaptability or versatility
If pestware detection systems analyze code structure, then detection coverage is improved, but system complexity increases due to handling obfuscation and polymorphism
Solution Approach 1:
The patent introduces a virtualized execution environment as an intermediary layer between the detection system and the pestware. This intermediary safely executes the malware code while capturing its behavioral parameters, shielding the detection system from the complexity of analyzing obfuscated and polymorphic code structures directly. The virtualization layer handles the complexity of execution safety and parameter capture, simplifying the overall detection architecture.
3Measurement precision
If function-parameter-based definitions are generated and stored, then detection accuracy improves, but data storage requirements increase
Solution Approach 1:
The patent extracts only the essential functional parameters from the complex execution traces. Instead of storing complete execution histories or all possible system states, the system identifies and stores only the critical function call parameters and their values that characterize pestware behavior. This selective extraction significantly reduces the volume of data that needs to be stored while maintaining high detection accuracy.
Solution Approach 2:
The patent creates a universal parameter representation framework that can capture multiple types of function calls and system operations through a standardized format. By using a unified data structure for diverse execution parameters, the system reduces redundancy and optimizes storage efficiency. The same storage mechanism handles various pestware types and execution scenarios, maximizing storage utilization.
Data Source
AI summary
A system and method for defining and detecting pestware is described. In one embodiment, a pestware file is received and at least a portion of the pestware file is placed into a processor-readable memory. A plurality of execution paths within code of the pestware file are followed and for each of a plurality of selected function calls within the execution paths of the pestware file, at least one parameter from each of the function calls is retrieved so as to obtain a plurality of parameters. A representation of each of the parameters is then stored in a processor-readable pestware-definition file, which is sent to a plurality of client devices.