Retroactive Malware Identification via Sandbox Traffic Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security techniques in computer networks fail to effectively identify malware programs that use obfuscation techniques, making it difficult to detect new families of unknown malware based on static signatures, especially when these signatures are not available at the time of network traffic analysis.
Innovation Solution
A method that involves obtaining packet capture files from sandbox environments, comparing them with newly obtained malware signatures, and retroactively identifying malware by updating a database with identifiers and timestamps, allowing for the correlation of previously unidentified malware samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malware uses obfuscation techniques to hide its true purpose, then the malware can avoid detection by static signatures and heuristics, but the ability to identify and classify malware is reduced
Solution Approach 1:
The system performs preliminary network traffic analysis in a sandbox environment before malware signatures are available. Packet capture files are collected and stored in advance, so when new signatures become available, they can be immediately applied to retroactively identify the malware without needing to re-execute it.
Solution Approach 2:
The patent introduces network traffic capture files and signature databases as intermediary elements between the malware and the detection system. These intermediaries enable indirect identification of obfuscated malware by matching network communication patterns against known malware signatures, bypassing the need for direct code analysis.
2Adaptability or versatility
If new malware families are continuously created with unknown signatures, then the diversity and evolution of malware threats increase, but the effectiveness of static signature-based detection decreases
Solution Approach 1:
The system proactively captures and stores network traffic from sandbox executions before signature updates are available. This preliminary action ensures that when new malware signatures are released, the system can immediately retroactively analyze stored traffic to identify previously unknown malware families, maintaining detection reliability despite continuous malware evolution.
Solution Approach 2:
The system implements a feedback loop where retroactive identification results from signature matching are used to update the malware database and improve future detection capabilities. This continuous feedback mechanism allows the system to adapt to new malware families while maintaining high detection reliability through accumulated knowledge.
3Object-affected harmful factors
If malware controllers and malware are modified to change obfuscation techniques, then the malware can evade existing detection methods, but the complexity of malware development and testing increases
Solution Approach 1:
The patent uses network traffic capture files as an intermediary that decouples the detection process from the malware code itself. By analyzing network communications rather than directly examining modified malware code, the system can identify obfuscated malware without being affected by changes in obfuscation techniques, reducing the impact of malware complexity on detection effectiveness.
Data Source
AI summary
Techniques are provided for retroactively identifying malware programs when new signatures become available that later match network traffic previously obtained from the sandbox environment. An exemplary method comprises obtaining a plurality of packet capture files comprising previously captured network communications of malware programs that previously executed in a sandbox environment, wherein each of the packet capture files are associated with a corresponding malware program that generated the network communications; obtaining signatures indicative of at least one malware program; comparing the signatures to the packet capture files; and retroactively identifying a given malware program as malware if a signature matches a given packet capture file associated with the given malware program. A plurality of malware samples that were previously unidentified are optionally correlated with the given malware program based on a scan of additional packet capture files for the signature that matched the given packet capture file.