Script and Machine Code Emulation for Malicious Executable Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for detecting malicious executable files, particularly those written in the AutoIt script language, face challenges due to complexity and obfuscation, making it difficult to differentiate between trusted and malicious code, and are resource-intensive, leading to inefficiencies in detection.
Innovation Solution
A system combining a script emulator and a machine code emulator is used to convert and emulate the code, allowing for efficient detection by analyzing the emulation results to determine if an executable file is malicious, reducing resource consumption and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based methods are used to detect malicious objects, then detection can be performed on known viruses, but the method is ineffective against obfuscated scripts and packed executable files
Solution Approach 1:
The patent introduces an intermediary layer (emulator and analyzer) between the executable file and the detection system. The emulator executes the file in a controlled virtual environment, translating its actions into observable events that the analyzer can process. This intermediary approach allows detection of both known and unknown malicious files, including obfuscated and packed files, by observing their runtime behavior rather than relying on static signature matching.
2Reliability
If traditional heuristic emulation methods are used to detect malicious files, then detection can be performed on unknown viruses, but the emulation process is very slow and resource-intensive
Solution Approach 1:
The patent segments the emulation process into distinct functional components: the emulator handles execution and event generation, while the analyzer handles detection logic. This segmentation allows parallel processing and optimization of each component independently, improving overall detection speed without sacrificing the ability to detect unknown viruses.
Solution Approach 2:
The system performs partial emulation by focusing only on the critical execution path and key events necessary for detection, rather than fully emulating every instruction. This selective approach maintains detection effectiveness for unknown viruses while significantly reducing the time and computational resources required.
3Reliability
If the interpreter performs many useless actions to prevent detection, then the malicious file can evade traditional detection systems, but the execution log size reaches gigabytes making analysis inefficient
Solution Approach 1:
The patent extracts and filters only the relevant execution events from the emulator output, separating useful detection information from useless actions. The analyzer identifies and processes only those events that are indicative of malicious behavior, ignoring benign or irrelevant operations. This extraction approach reduces the analysis workload from gigabytes of data to a manageable subset of critical events.
Solution Approach 2:
The system implements feedback mechanisms where the analyzer continuously monitors execution events and adjusts its analysis focus based on detected patterns. When suspicious behavior is identified, the system can intensify monitoring of related events; when benign behavior is detected, analysis can be reduced. This dynamic feedback approach optimizes analysis time while maintaining detection reliability.
Data Source
AI summary
Systems and methods to detect malicious executable files having a script language interpreter by combining a script emulator and a machine code emulator. A system includes an analyzer configured to convert a script into pseudocode and monitor an emulation process of the pseudocode, a script emulator configured to sequentially emulate the pseudocode and write emulation results to an emulator operation log, and a machine code emulator configured to emulate the pseudocode if a transition from pseudocode to machine code is detected by the analyzer, such that the analyzer can analyze the emulator operation log to determine if the executable file is malicious.