SMTP Proxy Dirty Page Emulation for Polymorphic Worm Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Polymorphic malicious code, such as polymorphic SMTP mass mailing worms, evade detection by changing its virus signature, making it difficult for anti-virus programs to prevent its spread via email attachments.
Innovation Solution
A method involving a SMTP proxy that emulates an SMTP client application, checks for 'dirty pages' generated during execution, and compares these with executable application pages to determine if the SMTP client application is polymorphic malicious code, taking protective action if a match is found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If polymorphic malicious code changes its virus signature to evade detection, then the malicious code's ability to spread is improved, but the detection capability of anti-virus programs deteriorates
Solution Approach 1:
The system performs preliminary emulation of the SMTP client application and executable application to generate dirty pages before actual transmission occurs. This advance analysis allows detection of polymorphic code patterns before they can spread, resolving the contradiction by detecting evolved signatures through behavioral analysis rather than static signature matching
Solution Approach 2:
The patent introduces an SMTP proxy as an intermediary between the SMTP client application and the mail server. This proxy intercepts and analyzes communications, enabling detection of polymorphic code through emulation and dirty page comparison without blocking legitimate email flow, thus maintaining detection capability against adaptive threats
2Measurement precision
If emulation and dirty page comparison methods are used to detect polymorphic code, then detection accuracy is improved, but computational overhead and system performance deteriorate
Solution Approach 1:
The system extracts only the critical comparison elements (dirty pages) from the full application execution context. By focusing analysis on specific memory pages that contain executable code patterns rather than analyzing entire applications, the system maintains high detection accuracy while reducing computational overhead and preserving system performance
Solution Approach 2:
The patent applies analysis resources selectively by comparing dirty pages only for applications suspected of being polymorphic worms. Rather than uniformly analyzing all email attachments, the system concentrates computational effort on localized suspicious cases, maintaining detection precision while minimizing overall performance impact
Data Source
AI summary
A method includes establishing a SMTP proxy, defining an application that forms a connection with the SMTP proxy as a SMTP client application, emulating the SMTP client application including generating at least one SMTP client application dirty page, intercepting an executable application sent from the SMTP client application with the SMTP proxy, emulating the executable application including generating at least one executable application dirty page. If a determination is made that the at least one SMTP client application dirty page is a match of the at least one executable application dirty page, a determination is made that the SMTP client application is polymorphic malicious code that is attempting to send itself and protective action is taken.