Static Malicious Code Detection via Intermediate Representation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious behavior in software programs, such as static analysis and dynamic analysis, are either labor-intensive or risky, and signature-based approaches can incorrectly flag legitimate software as malicious, leading to unnecessary disruptions.
Innovation Solution
Converting assembly code into an intermediate representation and tracking parameter paths within functions to analyze software execution behavior, allowing for the identification of parameter values and types without executing the code, thereby reducing complexity and risk.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is used to identify malicious behavior, then detection accuracy is improved, but risk of exposure to malicious behavior increases
Solution Approach 1:
The patent introduces an intermediate representation as a mediator between the binary code and the analysis process. The binary code is disassembled into assembly code, then converted to an intermediate representation that preserves behavioral information without requiring execution. This intermediary form allows accurate static analysis while eliminating the need to run the potentially malicious code, thus resolving the contradiction between detection accuracy and safety.
2Object-affected harmful factors
If static analysis is used to identify malicious behavior, then safety is improved, but detection accuracy deteriorates
Solution Approach 1:
The intermediate representation serves as an enhanced intermediary that captures execution behavior information statically. By converting assembly code to this intermediate form and tracking parameter paths, the system achieves detection accuracy comparable to dynamic analysis while maintaining the safety advantages of static analysis, as no code execution is required.
Solution Approach 2:
The patent performs preliminary disassembly and conversion to intermediate representation before any analysis takes place. Parameter paths are pre-computed and stored in the intermediate representation, allowing the analysis to proceed without executing the code. This preliminary preparation enables accurate static analysis by pre-processing the code into a form that reveals behavioral characteristics.
3Ease of operation
If signature based approaches are used to detect malicious behavior, then ease of operation is improved, but false positives increase
Solution Approach 1:
The patent changes the parameters used for detection from simple signature matching to detailed parameter path analysis. Instead of comparing fixed signatures that may match legitimate code, the system tracks how parameters flow through functions and analyzes their values and types. This parameter-level analysis provides more nuanced detection that reduces false positives while maintaining ease of automated operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention extends to methods, systems, and computer program products for identifying software execution behavior. Embodiments of the invention can be used to assist a user in a making a reasoned and informed decision about whether the behavior of executable code is malicious. Data indicative of executable code behavior can be collected statically without having to execute the executable code. Behavior data can be collected essentially automatically with little, if any, user involvement. A user initiates analysis of executable code and is provided a visual categorized representation of behavior data for the executable code.