Static Control Function Tree for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current detection technologies for undesirable computer code are vulnerable to structural modifications, making it difficult to detect and identify malicious code due to techniques like instruction reordering and code obfuscation.
Innovation Solution
A method that statically identifies control functions within computer code by constructing a control function tree based on complexity thresholds and function properties, allowing for the comparison of code behavior without requiring execution, and utilizing a function congruency table to evaluate similarities and detect undesirable code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If pattern-based detection technology is used to identify undesirable computer code, then detection simplicity is improved, but detection reliability deteriorates due to vulnerability to structural modifications
Solution Approach 1:
The patent transforms the detection approach from pattern-based (structural) parameters to behavior-based (functional) parameters. By analyzing what the code does rather than how it is structured, the system changes the detection parameters to be invariant under structural modifications like instruction reordering, junk data insertion, and code obfuscation, thereby maintaining high detection reliability while preserving simplicity.
Solution Approach 2:
The patent introduces an intermediary layer of behavioral analysis between the code and the detection mechanism. Instead of directly comparing code patterns, the system uses behavioral signatures and functional analysis as intermediaries to evaluate code intent, making detection robust against structural changes while maintaining operational simplicity.
2Productivity
If structural pattern matching is used for code detection, then detection speed is improved, but detection precision deteriorates due to code obfuscation techniques
Solution Approach 1:
The system changes detection from structural parameters (code patterns, syntax) to functional parameters (behavioral signatures, execution outcomes). This parameter transformation enables precise detection of obfuscated code by focusing on what the code accomplishes rather than its structure, maintaining high detection precision while preserving speed through efficient behavioral analysis.
Solution Approach 2:
The patent extracts the essential functional behavior from the code, separating it from the obfuscated structural elements. By taking out and analyzing only the critical behavioral components that define malicious intent, the system achieves high detection precision independent of code structure, while maintaining speed by avoiding exhaustive structural analysis.
3Measurement precision
If code execution is required to analyze behavior, then detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
The patent performs preliminary behavioral analysis through static code analysis and control flow graph construction before actual code execution. By pre-computing behavioral signatures and functional characteristics from the code structure alone, the system achieves high detection accuracy without requiring resource-intensive runtime execution, thus reducing system resource consumption while maintaining precision.
Data Source
AI summary
A security data structure, method and computer program product are provided. In use, computer code is received. Furthermore, functions in the computer code that control a behavior of the computer code when executed are statically identified.