Script Malware Detection via Emulation and Heuristics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware technologies face difficulties in detecting obfuscated and polymorphic script-based malware, as these forms evade detection by altering their code and behavior, making it impractical to create specific static signatures for all variants.
Innovation Solution
The technology processes script samples in an emulation environment, analyzing and interpreting their structure and content, and matching against generic and static signatures, with the option to perform heuristic analysis and iterative processing, allowing for dynamic updates of the runtime emulation environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If script-based malware is obfuscated and polymorphic to avoid detection, then detection difficulty increases, but false negative rate increases
Solution Approach 1:
The patent performs preliminary actions by collecting statistics and performing heuristic analysis on script samples before final detection. The system analyzes token frequency, string patterns, and code structure in advance to identify obfuscated malware, enabling early detection before the malware can execute its malicious payload.
Solution Approach 2:
The patent introduces an intermediary heuristic analysis layer between the script sample and the detection engine. This intermediary performs statistical analysis of token frequencies, string patterns, and code metrics to bridge the gap between obfuscated code and detectable signatures, enabling detection of polymorphic malware without requiring exact signature matches.
2Adaptability or versatility
If static signatures are created for all malware variants, then detection coverage improves, but device complexity increases
Solution Approach 1:
The patent makes the detection system universal by implementing heuristic analysis that can detect multiple malware variants simultaneously. Instead of requiring separate signatures for each polymorphic variant, the system uses statistical patterns and code metrics that apply across different obfuscation techniques, enabling one detection mechanism to handle diverse malware families.
Solution Approach 2:
The patent changes detection parameters by moving from exact signature matching to statistical threshold-based detection. The system analyzes token frequency distributions, string length patterns, and code metrics with configurable thresholds, allowing adaptive detection that adjusts to different obfuscation levels without requiring new signatures for each variant.
3Measurement precision
If heuristic analysis and emulation are performed on all script samples, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent applies partial action by performing heuristic analysis selectively rather than on all script samples. The system uses quick statistical checks on token frequency and string patterns to identify suspicious samples, then applies more resource-intensive emulation only to those that exceed thresholds, reducing overall processing time while maintaining detection accuracy for malicious scripts.
Solution Approach 2:
The patent segments the detection process into multiple stages: initial statistical analysis, heuristic evaluation, and optional emulation. This segmentation allows the system to quickly filter out benign scripts using lightweight metrics, reserving heavy computation only for samples that require deeper analysis, thereby optimizing the balance between accuracy and processing speed.
Data Source
AI summary
The subject disclosure is directed towards running script through a malware detection system including an emulator environment to detect any malware within the script. Statistics are collected as part of processing the script, with parameterized heuristic analysis used to determine whether to run the emulation. The processing through the malware detection system may be iterative, to de-obfuscate layers of obfuscated malware. The emulator may be updated via signatures.