Secondary File Analysis for Malware Evasion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security platforms fail to detect malicious payloads embedded in secondary files by malicious objects that bypass secure environments, allowing malware to spread unnoticed.
Innovation Solution
A security platform that utilizes a secure environment with a file directory to monitor and analyze secondary files accessed after opening a received file, identifying and preventing the spread of malicious payloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security platforms analyze files in secure environments, then malware detection capability is improved, but malware can embed malicious payloads in secondary files to evade detection
Solution Approach 1:
The system performs preliminary actions by monitoring and analyzing secondary files before the malware payload can execute or spread. By detecting modifications to secondary files in advance and analyzing their contents proactively, the system prevents malware from establishing its presence or spreading through the secure environment.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring secondary files for modifications and using this information to trigger further analysis. When a secondary file is modified, the system responds by analyzing the modified file and its contents, creating a closed-loop detection system that adapts to malware behavior.
2Measurement precision
If security platforms monitor all file access in secure environments, then malware detection accuracy is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system applies local quality by focusing monitoring and analysis resources on specific secondary files that show signs of modification or suspicious behavior, rather than uniformly monitoring all files. This targeted approach maintains high detection accuracy while reducing overall system complexity and resource consumption.
Solution Approach 2:
The system performs partial monitoring by selectively analyzing secondary files based on modification events rather than continuously monitoring all files. This partial action approach provides sufficient malware detection capability without the overhead of comprehensive continuous monitoring of every file in the environment.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A device may include one or more processors to receive a file that may be analyzed for malware; open the received file in a secure environment; determine that a secondary file in the secure environment may have been accessed based on the received file being opened; analyze the secondary file in the secure environment to identify malware; and/or perform an action associated with the received file based on the secondary file being analyzed.