Static Heuristic Code Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus methods, including heuristic analysis, face challenges in accurately detecting new and unknown malware due to their reliance on behavioral analysis in safe environments, which is time-consuming and prone to false alarms and missed detections, and are vulnerable to malware authors' evasion techniques.
Innovation Solution
A static heuristic method that analyzes program code without execution, focusing on technical purity by comparing instructions against suspicion criteria such as illogical operations, data transformations, jumps, and redundant sequences, assigning scores to determine a program's maliciousness based on thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heuristic analysis is used to detect new malware, then detection capability for unknown viruses is improved, but analysis time and resource consumption increase significantly
Solution Approach 1:
The patent segments the malware detection process into multiple independent heuristics that analyze different aspects of program behavior (e.g., file access patterns, registry modifications, network connections). Each heuristic operates independently and can be executed in parallel, reducing overall analysis time while maintaining comprehensive detection coverage through the combined results of multiple segmented analyses.
Solution Approach 2:
The patent performs preliminary analysis of program characteristics before full execution, including static analysis of code structure, identification of known malicious patterns, and prediction of potentially harmful behaviors. This preliminary action filters out clearly benign programs early and prepares analysis frameworks in advance, reducing the time required for complete dynamic analysis when needed.
2Reliability
If heuristic analysis is used to detect malware behavior, then ability to identify new viruses is improved, but false alarms on clean programs increase
Solution Approach 1:
The patent applies different heuristic criteria and analysis depths to different parts of the program based on their local characteristics. Critical sections that exhibit suspicious patterns receive intensified analysis, while clearly benign sections are analyzed more lightly. This localized quality adjustment reduces false alarms on clean programs while maintaining high detection accuracy for malicious software.
Solution Approach 2:
The patent incorporates feedback mechanisms that continuously refine detection accuracy by learning from both positive detections and false alarms. The system adjusts heuristic thresholds and analysis strategies based on feedback from analyzed programs, gradually improving precision by reducing false positives on clean software while maintaining sensitivity to actual malware threats.
3Reliability
If conventional antivirus methods are used, then detection of known malware is improved, but ability to detect new and unknown malware deteriorates
Solution Approach 1:
The patent employs dynamic heuristics that adapt their analysis behavior based on the specific characteristics of each program being scanned. Rather than using fixed signatures, the system dynamically adjusts detection strategies based on observed program behaviors, making it adaptable to new and unknown malware variants while maintaining effectiveness against known threats through learned patterns.
Solution Approach 2:
The patent changes analysis parameters and heuristic thresholds based on the context and characteristics of each program. By dynamically adjusting detection parameters rather than relying on fixed criteria, the system can effectively detect new malware variants while maintaining high accuracy for known malware, resolving the contradiction between adaptability and detection reliability.
4Reliability
If heuristic analysis is used to examine program behavior, then detection of suspicious activity is improved, but device complexity and operational overhead increase
Solution Approach 1:
The patent designs a universal heuristic framework that can analyze multiple types of programs and detect various suspicious activities using a single integrated system. The same core heuristics can be applied across different program types, operating systems, and malware variants, reducing overall system complexity while maintaining comprehensive detection capabilities through multi-functional analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of detecting malware at a computing device. The method includes examining a software program comprising a sequence of program instructions, determining whether each instruction in the sequence meets any of a group of suspicion criteria, assigning a instruction-level score to each instruction that meets any of the suspicion criteria, summing the instruction-level scores for each instruction to yield a program-level score, determining whether the program-level score exceeds a threshold, and, if the program-level score exceeds a threshold, developing a report indicating a malware detection result.