Runtime Malware Detection via Application Model Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity technologies lack the capability to examine computer applications at a low enough granularity and track malicious events over time, making it difficult to detect advanced persistent malware threats that adapt their behavior to evade detection.
Innovation Solution
The method involves extracting and storing a model of a computer application at load time, inserting instrumentation instructions to collect runtime data, and using a state machine to track security events, including transition mapping, memory mapping, and OS functions, to detect and correlate malicious activities in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current cybersecurity technologies (next generation firewalls, sandboxing) are used to detect malware, then malware detection capability is provided, but the detection reliability deteriorates because malware adapts its behavior to evade detection
Solution Approach 1:
The patent applies preliminary action by extracting and storing a model of the computer application at load time, including transition mapping data, memory mapping data, and soft spot data, before the application executes. This pre-built model serves as a baseline for detecting deviations caused by malware injection, enabling reliable detection even when malware adapts its behavior during runtime execution.
2Measurement precision
If cybersecurity technologies examine applications at runtime, then detection capability is provided, but the granularity of examination is insufficient to reliably detect injection events
Solution Approach 1:
The patent applies segmentation by dividing the application model into distinct components: transition mapping data (function call relationships), memory mapping data (memory region allocations), and soft spot data (potential vulnerability locations). This segmentation allows the system to examine each aspect at high granularity independently, making injection detection more precise without overwhelming complexity in the overall examination process.
3Reliability
If cybersecurity technologies track behavior over time, then detection capability is provided, but the ability to correlate events and identify attacks before malicious intent is carried out is insufficient
Solution Approach 1:
The patent applies feedback by continuously comparing runtime execution data against the pre-stored application model and generating alerts when deviations are detected. The system tracks security events over time and correlates them to identify attack patterns, providing timely feedback that enables detection before the malware completes its malicious intent, thus reducing the loss of time for attack prevention.
Data Source
AI summary
One example method and correspond apparatus extracts a model of a computer application during load time and stores the model of the computer application in a database. This example method and corresponding apparatus also inserts instructions into the computer application to collect data at runtime. This example method and corresponding apparatus then analyzes the data collected at runtime against the stored model of the computer application to detect one or more security events and tracks the one or more security events using a state machine.