Single-Process Malware Analysis Using Multiple Application Versions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches for dynamic malware analysis are inefficient and costly in terms of computational resources, as they typically require executing multiple processes to open samples using different versions of applications, which wastes resources and time.
Innovation Solution
The technique involves rendering an object using multiple versions of an application in a single process within an instrumented virtual machine environment, optimizing resource usage by executing and monitoring samples in a single browser process, such as Microsoft Internet Explorer or Google Chrome, and utilizing browser helper objects to enumerate and intercept functions for efficient malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple processes are executed to open samples using different versions of applications, then malware analysis coverage is improved, but computational resource usage increases
Solution Approach 1:
The patent merges multiple application versions into a single process by injecting different versions of applications (such as Flash Player, Acrobat Reader, Java) within one browser process context. This allows the malware sample to be analyzed against multiple application versions without spawning separate processes for each, thereby maintaining comprehensive analysis coverage while significantly reducing computational resource overhead.
Solution Approach 2:
The single browser process is designed to perform multiple functions by dynamically loading and executing different versions of applications. The process acts as a universal analysis environment that can test malware compatibility and behavior across multiple application versions simultaneously, replacing the need for multiple specialized processes.
2Measurement precision
If multiple processes are executed to analyze samples with different application versions, then detection accuracy is improved, but analysis time increases
Solution Approach 1:
The patent enables continuous malware analysis by maintaining a single persistent browser process that sequentially executes different application versions without process termination and restart overhead. The analysis action continues uninterrupted across different application versions, eliminating the time loss associated with process initialization, loading, and context setup that would occur with multiple separate processes.
3Adaptability or versatility
If multiple processes are used for dynamic malware analysis, then analysis thoroughness is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complexity of managing multiple application versions from the process level and relocates it to the injection level within a single process. By using injection techniques to load different application versions into the same process memory space, the system eliminates the need for complex inter-process communication, process synchronization, and resource management that would be required if multiple processes were used.
Data Source
AI summary
Techniques for rendering an object using multiple versions of an application in a single process for dynamic malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for rendering an object using multiple versions of an application in a single process for dynamic malware analysis includes receiving a sample at a cloud security service, in which the sample includes an embedded object; detonating the sample using a browser executed in an instrumented virtual machine environment; and rendering the embedded object using a plurality of versions of an application in a single process during a dynamic malware analysis using the instrumented virtual machine environment.