Program Analysis System for Malware Detection via Mathematical Modeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in analyzing and detecting malware, particularly unknown malware and zero-day attacks, as they fail to properly analyze the content of malicious programs and determine the presence of fraudulent code effectively.
Innovation Solution
A program analysis system that transforms execution code into a mathematical model, allowing for the identification of known factor codes and success states, thereby determining whether an execution code is fraudulent by comparing it against known codes and success states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware analysis is performed using conventional methods (URL monitoring, communication data analysis, virtual machine analysis), then known malware can be detected, but unknown malware and zero-day attacks cannot be effectively detected
Solution Approach 1:
The patent transforms execution code from its original form into a mathematical model representation, changing the parameter space in which malware is analyzed. This transformation enables the detection of unknown malware by comparing structural mathematical properties rather than relying on known malware signatures or behaviors, thus improving both detection accuracy and adaptability to new threats
Solution Approach 2:
The patent replaces conventional malware analysis methods (URL monitoring, communication analysis, virtual machine execution) with a mathematical model-based approach. By substituting the mechanical/empirical analysis system with a mathematical transformation and comparison system, the patent achieves the ability to detect unknown malware through structural analysis rather than behavior-based detection
2Reliability
If virtual machine environment is used for malware analysis, then malware behavior can be observed, but the analysis may be incomplete when malware changes behavior in VM environments
Solution Approach 1:
The patent creates a mathematical model copy of the execution code that preserves the essential structural properties of the malware regardless of the execution environment. This mathematical representation serves as an environment-independent copy that can be reliably analyzed without being affected by VM-specific behavior changes, thus maintaining both reliability and precision
3Ease of operation
If emulation with predefined malicious processing states is used, then known attack patterns can be detected, but unknown attacks cannot be sufficiently handled
Solution Approach 1:
The patent changes the detection parameter from predefined malicious states to mathematical model properties. By transforming code into a mathematical representation and comparing structural features, the system maintains operational simplicity while gaining the ability to detect unknown attacks through pattern recognition in the mathematical space rather than relying on predefined attack scenarios
Data Source
AI summary
A program analysis method according to an exemplary aspect of the present disclosure includes: generating an analysis-target abstract code that is data representing a mathematical model into which an inspection-target execution code is transformed; and determining whether or not the inspection-target execution code is a fraudulent program by executing at least processing of determining whether or not the analysis-target abstract code includes a known factor code that is data representing a mathematical model into which a known execution code is transformed, and processing of determining whether or not a state at an end of execution of the inspection-target execution code is included in success state information indicating a state in which an attack by a fraudulent program is successful.