Static API Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems are inefficient in identifying modified malware due to their reliance on signature-based detection and time-consuming emulation or sandbox methods, which are impractical for large-scale screening.
Innovation Solution
A method using static analysis to detect improper application programming interfaces (APIs) in files, comparing them against specifications to identify suspected malware, without the need for emulation, by analyzing parameters, import sizes, supporting APIs, input parameters, parameter values, and usage of output values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used to identify malware, then detection accuracy for known malware is improved, but detection capability deteriorates when malware signatures are modified
Solution Approach 1:
The patent transitions from signature-based detection to static analysis of API parameters, import sizes, and code structure. By changing the detection parameters from surface-level signatures to deeper structural and behavioral characteristics, the system maintains high detection accuracy while becoming adaptable to modified malware variants that preserve their core functionality despite signature changes.
2Reliability
If emulation or sandbox methods are used to detect malware, then detection thoroughness is improved, but processing time increases making it impractical for large-scale screening
Solution Approach 1:
The patent extracts and analyzes only the essential static characteristics of malware files (API parameters, import sizes, code structure) without executing or emulating the full malware behavior. This extraction approach maintains reliable detection by focusing on critical identifying features while dramatically reducing processing time by avoiding time-consuming emulation of entire malware execution cycles.
Solution Approach 2:
The patent performs partial analysis by examining specific static features (API parameters, import tables, code structure) rather than complete malware execution. This partial action approach provides sufficient detection reliability for large-scale screening by analyzing only the most discriminative features, avoiding the need for exhaustive emulation while maintaining effective malware identification.
3Productivity
If static analysis of API parameters and code structure is performed, then processing speed for large-scale screening is improved, but detection precision may deteriorate compared to dynamic analysis
Solution Approach 1:
The patent applies local quality by performing targeted static analysis on specific critical regions of the malware code (API parameter definitions, import tables, function signatures) rather than attempting comprehensive analysis of all code. This focused approach maintains high detection precision by examining the most discriminative local features while enabling fast processing speed by avoiding analysis of less relevant code sections.
Data Source
AI summary
A method for identifying malware is provided. The method includes performing a static analysis of a plurality of files and for each file of the plurality of files, determining in the static analysis whether the file includes an application programming interface (API). For each file, of the plurality of files, found to have an application programming interface, the method includes determining in the static analysis whether the application programming interface is proper in the file and alerting regarding an improper application programming interface when found in one of the plurality of files. A scanner for detecting malware is also provided.