Polymorphic Code Transformation for Malware Deflection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Illicit organizations interfere with online transactions by installing malware on user devices, which existing technologies struggle to effectively detect and deflect, especially as malware evolves to exploit changing web code structures.
Innovation Solution
Implementing polymorphic code transformation systems that analyze original web code to identify static elements that can be altered without affecting user experience, creating maps for consistent random name substitutions across servings, thereby creating a moving target for malware and enabling malware detection through instrumentation code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code elements are constantly changed to deflect malware, then malware detection capability is improved, but computational cost increases
Solution Approach 1:
The system performs preliminary analysis of web code to identify static elements that can be transformed before the code is served. This analysis creates a map of transformable elements in advance, so that when code needs to be changed for malware deflection, the system can quickly apply pre-identified transformations without performing full analysis each time, thus reducing computational cost while maintaining detection capability
Solution Approach 2:
The system changes specific parameters of the code such as function names, variable names, and other identifiers while preserving the functional behavior. By selectively transforming only certain parameters (names and labels) rather than the entire code structure, the system achieves malware deflection with reduced computational overhead compared to comprehensive code rewriting
2Reliability
If polymorphic code transformation is applied to all code elements, then malware deflection effectiveness is improved, but user experience deteriorates
Solution Approach 1:
The system applies polymorphic transformation selectively to specific local elements within the code rather than uniformly to all elements. It identifies and transforms only static elements such as function names, variable names, and identifiers that do not affect user-facing functionality. This localized approach maintains malware deflection effectiveness while preserving the user experience by leaving dynamic and user-visible elements unchanged
3Measurement precision
If code analysis is performed for each serving, then malware detection accuracy is improved, but service response time increases
Solution Approach 1:
The system performs code analysis in advance to create a map of transformable elements before code is served. This preliminary analysis stores information about which elements can be safely transformed, allowing the system to skip full analysis during code serving and only apply pre-determined transformations, thus maintaining detection accuracy while reducing service response time
Solution Approach 2:
The system implements a dynamic approach where the level of analysis performed depends on the situation. For frequently accessed code, it uses cached analysis results and applies only necessary transformations. For new or modified code, it performs full analysis. This dynamic adjustment of analysis depth optimizes the balance between detection accuracy and response time
Data Source
AI summary
A computer-implemented method includes identifying first code for a content that has not been analyzed for purposes of transforming the first code before serving the code in response to future requests for the first code; analyzing the first code to identify portions of the first code that can be changed without affecting a manner in which the first code will function on client devices; subsequently receiving a request for the content; applying rules generated from analyzing the first code to a currently-served version of the first code, so as to obfuscated the currently-served version of the first code; and providing the obfuscated version of the currently-served version of the first code to a computing device that provide the request.