Stack Trace Analysis for Non-Executable Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity technologies struggle to detect and respond to new or variant malware, decoy information, and advanced persistent threats (APT) effectively, lacking standardized methods for describing malware and attack techniques, and are limited in predicting future cyber threats.
Innovation Solution
A cyber threat information processing apparatus and method that generates stack trace information at system call hooking points to identify calling functions and variables, providing description information for non-executable files, enabling rapid identification and prediction of malware, attack techniques, and attackers using machine learning and standardized schemes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional pattern-based detection methods are used, then detection speed and accuracy are improved for known malware, but detection capability deteriorates for new or variant malware without established patterns
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing multiple types of information (file information, process information, network information, registry information) before a cyber threat is fully executed. This advance preparation enables the generation of comprehensive threat profiles that can match against new malware variants even before established patterns exist, resolving the contradiction between needing accurate pattern matching and adapting to new threats.
Solution Approach 2:
The invention combines multiple types of information (static file information, dynamic process information, network communication information, registry changes) to create a composite threat profile. This composite approach allows the system to detect new malware variants by analyzing the combination of characteristics across different information types, rather than relying on a single pattern type, thus improving both accuracy for known threats and adaptability to new threats.
2Productivity
If AI analysis is used to detect and analyze malware, then analysis capability is improved, but fundamental countermeasure technology remains lacking and decoy information causes confusion
Solution Approach 1:
The system introduces an intermediary layer of comprehensive information collection and standardized description between the malware sample and the AI analysis engine. By gathering multiple types of information (file, process, network, registry) and describing them in a standardized format, the system provides more reliable and comprehensive input to AI analysis, reducing the impact of decoy information and improving the reliability of countermeasures while maintaining high productivity.
Solution Approach 2:
The invention creates a universal information collection framework that gathers multiple types of data (static and dynamic analysis, network traffic, registry changes) that can serve multiple purposes: training AI models, detecting new malware variants, and providing standardized descriptions for threat intelligence sharing. This multi-functional approach enhances both productivity and reliability simultaneously.
3Measurement precision
If individual case-focused detection methods are used, then specific malware identification is improved, but prediction capability for future cyber threats deteriorates
Solution Approach 1:
The system implements feedback mechanisms by continuously collecting information from multiple sources, analyzing it with AI, and using the results to refine threat profiles and improve future detection. The standardized description framework enables this feedback to be systematically applied across different cases, allowing the system to maintain high identification accuracy for specific malware while simultaneously improving prediction capability for future threats through accumulated learning.
4Productivity
If standardized description methods are implemented, then information normalization is improved, but system complexity increases
Solution Approach 1:
The system segments the information collection and processing into distinct modules: file information collection, process information collection, network information collection, registry information collection, and standardized description generation. This segmentation allows each module to focus on a specific type of information, making the overall system more manageable despite the increased complexity required for comprehensive standardized description.
Data Source
AI summary
A cyber threat information processing method including generating stack trace information of a reader program of an operating system executing a non-executable file at a hooking point of a system call of the operating system when the reader program performs the system call, obtaining a calling function for calling the system call and a variable corresponding to the calling function from the generated stack trace information, and providing description information about the obtained calling function and the variable corresponding to the calling function.