Runtime Malware Detection via Memory Morphing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern malicious code, such as Just-in-Time (JIT) compiled shellcode, evades detection by traditional anti-malware techniques due to its ability to be obfuscated and executed without leaving a static footprint, making it difficult to detect and analyze.
Innovation Solution
The described method involves detecting and suspending deobfuscated malicious code that attempts to access restricted memory regions, and then obtaining a snapshot of runtime characteristics to determine indicators of compromise, which are used to generate signatures for subsequent detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anti-malware scanning is used to detect malicious code, then detection capability against static malware is improved, but detection capability against obfuscated JIT compiled shellcode deteriorates
Solution Approach 1:
The system transitions from static file scanning to dynamic runtime monitoring. It instruments target processes to monitor code execution behavior in real-time, detecting malicious patterns during actual runtime rather than relying on static signatures of files that may not exist or have been obfuscated.
Solution Approach 2:
The system performs preliminary instrumentation of target processes before malicious code execution. By pre-installing monitoring hooks and establishing baseline behavior patterns, the system is prepared to detect anomalies when obfuscated malware attempts to execute, rather than reacting after detection is too late.
2Loss of information
If obfuscated malicious code is allowed to execute fully, then analysis of complete malware behavior is improved, but loss of evidence deteriorates as malware deletes its traces
Solution Approach 1:
The system rapidly captures execution state information during the brief window before malware self-destructs. By prioritizing and accelerating the collection of memory dumps, register states, and call stack information, the system secures analytical evidence before the malware has opportunity to delete its traces.
Solution Approach 2:
The system preliminarily establishes monitoring hooks and state capture mechanisms before malware execution begins. This pre-positioning of detection capabilities ensures that when malicious code runs, its behavior and state are captured immediately, preserving evidence even if the malware executes for only a brief period before deletion.
3Adaptability or versatility
If runtime monitoring is implemented to detect obfuscated malware, then detection of JIT compiled shellcode is improved, but system complexity increases
Solution Approach 1:
The system introduces an intermediary instrumentation layer between the target process and the detection system. This mediator instruments the target process to generate standardized event streams that feed into the analysis engine, simplifying the overall architecture by providing a clear interface between monitoring and analysis components.
Solution Approach 2:
The runtime monitoring system is designed with universal, reusable components that can detect multiple types of malicious code through common patterns. The instrumentation framework and analysis engine are built to handle various obfuscation techniques and malware families through a unified approach, reducing overall system complexity despite the versatility achieved.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments described herein enable the detection, analysis and signature determination of obfuscated malicious code. Such malicious code comprises a deobfuscation portion that deobfuscates the obfuscated portion during runtime to generate deobfuscated malicious code. The techniques described herein deterministically detect and suspend the deobfuscated malicious code when it attempts to access memory resources that have been morphed in accordance with embodiments described herein. This advantageously enables the deobfuscated malicious code to be suspended at its initial phase. By doing so, the malicious code is not given the opportunity to delete its traces in memory regions it accesses, thereby enabling the automated exploration of such memory regions to locate and extract runtime memory characteristics associated with the malicious code. Such characteristics may be analyzed to automatically determine indicators of compromise, which can be used as signatures of the malicious code for subsequent runtime detection of malicious code.