Polyglot File Detection via Scoring and Sandboxing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems, such as signature-based scanners, fail to detect malicious polyglot files due to their dual nature as valid files in multiple formats, and file-less security systems often miss polyglot files in their inactive state, making it difficult to identify and prevent threats like data exfiltration and command and control scenarios.
Innovation Solution
A system and method that combines format specification analysis, data structure decomposition, programming language estimation, and sandboxed testing to detect polyglot files by assigning a polyglotness score based on anomalies and executable content, using a security engine to analyze files for potential source code and execute them in a sandbox to determine their validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based scanners are used to detect malicious files, then detection speed is maintained, but detection accuracy fails for polyglot files due to their dual format nature
Solution Approach 1:
The detection system is divided into multiple specialized modules: a polyglot detection module that identifies polyglot files using format specification analysis, and a sandbox module that executes files in isolated environments. This segmentation allows each module to specialize in specific detection tasks, improving overall accuracy without requiring the entire system to become overly complex.
Solution Approach 2:
A polyglotness score is introduced as an intermediary metric to bridge the gap between format analysis and malware detection. The score quantifies the likelihood that a file is a polyglot, enabling the system to prioritize and handle suspicious files appropriately without immediately executing them, thus improving detection accuracy while maintaining manageable system complexity.
2Reliability
If file-less security systems are used to detect active threats, then real-time protection is provided, but inactive polyglot files are missed
Solution Approach 1:
The system performs preliminary analysis of files upon receipt or before execution, calculating a polyglotness score and identifying polyglot characteristics in advance. This preliminary action ensures that inactive polyglot files are detected and flagged before they can execute malicious code, improving reliability without requiring continuous monitoring of all files.
Solution Approach 2:
The system changes the parameter being measured from simple file type identification to a polyglotness score that quantifies the degree to which a file exhibits polyglot characteristics. This parameter change makes previously undetectable inactive polyglot files measurable and detectable, addressing the detection difficulty while maintaining reliability.
3Measurement precision
If polyglot files are executed in sandbox to determine validity, then accurate detection is achieved, but processing time increases
Solution Approach 1:
The system applies partial action by executing only the portion of polyglot files that are suspected of containing malware, rather than executing entire files or all files uniformly. Files with low polyglotness scores are handled quickly without sandbox execution, while only high-scoring files undergo time-consuming sandbox analysis, reducing overall processing time while maintaining detection accuracy for suspicious files.
4Adaptability or versatility
If multiple analysis methods are combined to detect polyglot files, then detection capability is improved, but system complexity increases
Solution Approach 1:
The detection system is divided into multiple specialized modules: a polyglot detection module that identifies polyglot files using format specification analysis, and a sandbox module that executes files in isolated environments. This segmentation allows each module to specialize in specific detection tasks, improving overall accuracy without requiring the entire system to become overly complex.
Solution Approach 2:
The system employs a unified polyglotness score calculation that can be applied across different file types and formats, providing a universal detection mechanism. This multi-functional approach allows the same core algorithm to handle various polyglot scenarios (e.g., PDF containing executable code, image files containing scripts), enhancing detection capability while avoiding the need for separate specialized systems for each file type.
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to identify a file, determine a polyglotness score for the file, where the polyglotness score is an indicator of whether or not the file is a polyglot file, and analyze the file for the presence of malware if the polyglotness score satisfies threshold.