ROP Code Detection via Byte Sequence Probability Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting Return-Oriented Programming (ROP) codes in malicious document files are either time-consuming, prone to erroneous detection, or can be evaded by attackers, particularly due to the limitations of dynamic analysis and deterministic detection approaches.
Innovation Solution
A device and method that generates a probability model based on known malicious data series to learn the features of byte sequences, enabling high-speed and accurate detection of ROP codes without requiring the execution of an inspection target document file, using a learning unit to label byte sequences as either document or ROP code components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is used to detect ROP codes by monitoring execution commands, then detection accuracy is improved, but inspection time increases significantly and productivity decreases
Solution Approach 1:
The patent performs preliminary analysis during the model generation phase by executing sample documents and monitoring execution commands to collect training data. This preliminary action captures ROP code characteristics in advance, allowing the detection model to be trained offline. During actual inspection, the pre-trained model can quickly analyze documents without requiring time-consuming dynamic execution monitoring, thus resolving the contradiction between detection accuracy and inspection speed.
2Reliability
If deterministic detection methods are used to identify ROP codes, then detection reliability is improved, but attackers can evade detection by modifying their codes, reducing adaptability
Solution Approach 1:
The patent transforms the detection approach from deterministic to probabilistic by changing the fundamental parameter of detection methodology. Instead of using fixed rules that attackers can evade, the system employs a machine learning model that outputs probability scores. This parameter change allows the system to adapt to various ROP code variations while maintaining reliable detection through confidence thresholding, thus resolving the contradiction between reliability and adaptability.
3Adaptability or versatility
If encoded shellcodes are used in malicious documents, then the ability to execute arbitrary code is maintained, but detection becomes difficult as code features are hidden
Solution Approach 1:
The patent introduces an intermediary approach by using probability-based detection as a mediator between the encoded shellcode and the detection system. Rather than attempting to directly decode or identify specific shellcode patterns, the machine learning model acts as an intermediary that analyzes probabilistic patterns in the encoded code. This intermediary detection mechanism can identify malicious characteristics even when traditional features are hidden by encoding, thus resolving the contradiction between attack capability and detection difficulty.
Data Source
AI summary
An attack code detection device includes a learning unit configured to generate a model that learns, using a known labeled malicious document file including an ROP code, as learning data, a feature of a byte sequence being a component of a document file, and a feature of a byte sequence being a component of an ROP code, a detection unit configured to detect the ROP code included in an inspection target unknown document file, based on the model, and a malignancy determination unit configured to determine, based on a detection result, whether the inspection target unknown document file is a malicious data series that executes attack using ROP.