Subroutine Reputation Scoring for Infrequent Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems face challenges in detecting malware that is injected into legitimate software or applications, particularly when the malicious code is designed to execute infrequently, making it difficult to identify and isolate, especially in distributed environments like app stores where wide distribution occurs.
Innovation Solution
The system analyzes executable objects at the subroutine level, assigning execution frequency scores and pseudo-unique identifiers, allowing for the identification and flagging of suspicious subroutines that are executed infrequently, which can indicate malware, and provides a reputation scoring system to aid in cross-referencing and quarantining or scrubbing such code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware is injected into legitimate software and designed to execute infrequently, then the malware can evade detection by traditional anti-malware systems, but this makes the malware harder to identify and isolate
Solution Approach 1:
The patent segments the analysis from the executable object level to the subroutine level. By analyzing individual subroutines separately and assigning them unique identifiers, the system can detect malicious subroutines even when they are embedded within legitimate software. This segmentation allows the detection system to isolate and identify specific malicious code segments without being obscured by the surrounding legitimate code.
Solution Approach 2:
The patent introduces an intermediary layer of subroutine-level analysis and reputation scoring. Instead of directly analyzing the entire executable object, the system uses subroutines as intermediaries to detect malware. Each subroutine is analyzed independently, assigned a reputation score, and tracked separately, allowing the system to identify malicious subroutines that execute infrequently while maintaining the ability to detect them through this intermediary analysis layer.
2Productivity
If malware is widely distributed across multiple applications and devices, then the impact of the malware increases, but tracking and remediating the infected code becomes more complex
Solution Approach 1:
The patent creates copies of subroutine-level reputation data and tracking information across the distributed system. Each subroutine is assigned a unique identifier and reputation score that can be copied and shared across multiple devices and applications. This allows the system to track the same malicious subroutine across different instances without requiring complex centralized tracking, as the reputation information is replicated and shared through the subroutine identifiers.
Solution Approach 2:
The patent creates a universal subroutine-level reputation system that can be applied across multiple applications and devices. The same analysis methodology, scoring system, and tracking mechanism work universally for any executable object, regardless of which application or device it is on. This universality simplifies remediation because the same tools and procedures can be used to identify and address malicious subroutines anywhere in the distributed system.
3Reliability
If traditional anti-malware systems analyze entire executable objects, then they can provide comprehensive security coverage, but they cannot effectively identify malware injected into specific subroutines
Solution Approach 1:
The patent divides the executable object into smaller subroutine segments for analysis. Instead of treating the entire executable as a single unit, the system analyzes each subroutine individually, assigning separate reputation scores and identifiers to each segment. This segmentation enables precise identification of which specific subroutine contains malware, improving measurement precision while maintaining comprehensive security coverage through the analysis of all subroutines.
Solution Approach 2:
The patent applies local quality analysis by treating each subroutine with its own specific analysis and reputation scoring, rather than applying a uniform analysis to the entire executable object. Each subroutine is evaluated on its own merits and assigned a local reputation score that reflects its specific characteristics and risk level. This allows the system to identify malicious subroutines with high precision while maintaining overall security coverage through the collective analysis of all subroutines.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
In an example embodiment, there is disclosed an anti-malware system and method that analyzes applications and other executable objects at the subroutine level. Each subroutine may be assigned an execution frequency score, which may be based on simulated execution in an insulated environment, on real-world operating conditions, or on static analysis. Each subroutine may be assigned an execution frequency score based on how frequently it is executed. Based on this score, each subroutine may also be assigned a reputation score. To aid in cross-referencing to occurrences of the same subroutine in other applications, the subroutine may also be assigned a pseudo-unique identifier, such as a fuzzy fingerprint.