Runtime Exploit Detection via Dynamic Binary Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malware, especially repackaged versions, struggle due to their reliance on pattern matching and deep packet inspection, which can fail to detect hidden or obfuscated malicious code, leading to evasion and silent execution.
Innovation Solution
The proposed solution involves running potentially exploitative code as a child process and analyzing data associated with internal structures of the program code for suspicious activity, using instrumentation code that remains transparent to the application, and employing techniques like dynamic binary instrumentation to detect anomalies and classify received computer information as suspicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional pattern matching and deep packet inspection methods are used to detect malware, then detection can be performed on known malware signatures, but repackaged and obfuscated malware can evade detection
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavior analysis. Instrumentation code is injected into the target application to monitor runtime behavior, allowing the detection system to adapt to obfuscated malware by observing actual execution patterns rather than relying on predetermined signatures.
Solution Approach 2:
An intermediary detection system is introduced between the malware and the operating system. The instrumentation code acts as a mediator that intercepts and monitors API calls and system interactions, enabling detection of malicious behavior without requiring direct access to the malware's internal structure.
2Reliability
If instrumentation code is injected into the target application to monitor behavior, then real-time detection of suspicious activity is enabled, but the complexity of the detection system increases
Solution Approach 1:
The target application essentially monitors itself through injected instrumentation code. The application's own execution context, memory space, and API call sequences are used to generate detection data, eliminating the need for external monitoring systems to complexly analyze external processes.
Solution Approach 2:
The detection functionality is merged with the target application's execution environment. By injecting instrumentation code directly into the application, the detection system leverages the application's existing runtime context, memory structures, and execution flow, reducing the need for separate complex monitoring infrastructure.
3Loss of information
If memory extraction of code is performed to analyze malicious code, then the code can be examined, but operating system events are not generated and the code can silently execute and be removed
Solution Approach 1:
Detection actions are performed preliminarily during the malware's execution rather than after memory extraction. The instrumentation code monitors and analyzes malicious behavior as it occurs in real-time, enabling detection and response before the malware can complete its harmful actions or be silently removed.
Solution Approach 2:
A feedback loop is established through the instrumentation code that continuously monitors the application's behavior and provides real-time detection feedback. This enables the system to respond to suspicious activities as they occur, preventing silent execution and removal of malware by maintaining continuous observation of the execution context.
Data Source
AI summary
The present disclosure is directed to monitoring internal process memory of a computer at a time with program code executes. Methods and apparatus consistent with the present disclosure monitor the operation of program code with the intent of detecting whether received program inputs may exploit vulnerabilities that may exist in the program code at runtime. By detecting suspicious activity or malicious code that may affect internal process memory at run-time, methods and apparatus described herein identify suspected malware based on suspicious actions performed as program code executes. Runtime exploit detection may detect certain anomalous activities or chain of events in a potentially vulnerable application during execution. These events may be detected using instrumentation code when a regular code execution path of an application is deviated from.