Software Inspection System Using Model Checking for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as pattern matching and anomaly detection, are ineffective against unknown malware and can be easily evaded through mutation or adaptive training, leading to false negatives and positives.
Innovation Solution
A method employing a model checker to analyze executable binary code by creating a composite model using language definition and security rules, segmenting the code, and using model checking systems like Alloy Analyzer or Isabelle to identify rule violations indicative of malware, without relying on pre-known signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching with signatures is used to detect malware, then detection accuracy for known malware is improved, but the system cannot detect previously-unknown malware and is easily defeated by mutation
Solution Approach 1:
The patent segments malware detection into two independent components: signature-based pattern matching for known threats and anomaly-based behavioral analysis for unknown threats. This segmentation allows each method to operate optimally without compromising the other, enabling simultaneous detection of both known and unknown malware while maintaining high accuracy.
Solution Approach 2:
The patent merges signature-based detection and anomaly-based detection into a unified hybrid system. The signature component provides precise detection of known malware, while the anomaly component detects previously-unknown malware by identifying deviations from normal behavior patterns, thereby resolving the contradiction between detection accuracy and adaptability to unknown threats.
2Adaptability or versatility
If anomaly detection is used to detect malware, then ability to detect unknown malware is improved, but the system produces false positives and can be defeated by maladaptive training
Solution Approach 1:
The patent introduces signature-based detection as an intermediary layer that validates anomaly detection results. When the anomaly detector identifies suspicious behavior, the signature component verifies whether it matches known malware patterns, thereby reducing false positives while preserving the ability to detect unknown malware.
Solution Approach 2:
The patent implements feedback mechanisms where detection results from both anomaly and signature components are continuously exchanged and refined. False positives from anomaly detection are fed back to adjust thresholds and improve accuracy, while signature updates inform the anomaly component of new malware patterns, creating a self-improving system that reduces false positives while maintaining adaptability.
3Measurement precision
If signature files are updated frequently to counter malware mutations, then detection accuracy is maintained, but system complexity and update overhead increase
Solution Approach 1:
The patent performs preliminary anomaly detection before signature matching, filtering out obviously benign files early in the process. This preliminary action reduces the number of files requiring full signature-based analysis, thereby reducing the frequency and overhead of signature updates while maintaining detection accuracy for both known and unknown malware.
Data Source
AI summary
A method for software inspection analyzes a body of computer code to assess whether the body of computer code contains malware. Various embodiments extract the executable elements of the body of computer code and modify those elements using rules defining the format of instructions for the programming language in which the computer code was written, and using rules defined from the security specification of that programming language, to produce a model of the body of computer code. The method then analyzes the model using a model checking system, which determines whether any of the language rules have been violated, in which case the method flags the computer code as potentially including malware.