Taint Tag Malware Routing for Safe Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for dynamically analyzing malware struggle to analyze behavior without harming other parties, particularly when communication destinations are unknown or payloads are obfuscated, as they rely on IP addresses and communication payloads for switching between real and simulating Internet networks.
Innovation Solution
An information processing system that includes a simulating Internet apparatus, a real Internet connection apparatus, and a malware communication destination switching apparatus, which uses taint tags to determine whether data should be transmitted over a real or simulating Internet network, allowing precise switching based on taint tags assigned to data in the malware execution environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional dynamic analysis methods are used to track malware behavior, then malware functions can be analyzed, but it becomes difficult to prevent harm to other parties when malware communicates with unknown destinations or uses obfuscated payloads
Solution Approach 1:
The patent introduces a communication destination switching apparatus that acts as an intermediary between the malware execution environment and the real Internet network. This apparatus monitors communication requests, checks for taint tags in data, and routes traffic appropriately - blocking harmful communications while allowing legitimate analysis to proceed, thus preventing harm to third parties without compromising analysis accuracy
Solution Approach 2:
The system performs preliminary actions by assigning taint tags to sensitive data before malware execution. The communication destination switching apparatus is pre-configured to monitor and control communication destinations. This preliminary setup enables the system to proactively identify and block harmful communications before they reach third parties, rather than reacting after damage occurs
2Adaptability or versatility
If switching between real and simulating Internet networks is based on IP addresses and communication payloads, then communication can be routed appropriately, but the system cannot handle unknown destinations or obfuscated payloads effectively
Solution Approach 1:
The patent replaces the conventional mechanical approach of matching IP addresses and payload patterns with a data-driven taint tag system. Instead of relying on identifiable communication characteristics that can be obfuscated, the system uses invisible tags embedded in the data itself, making the routing mechanism independent of payload content and destination address visibility
Solution Approach 2:
The system changes the fundamental parameter used for communication routing from external identifiers (IP addresses, payload patterns) to internal data attributes (taint tags). This parameter change enables the system to accurately identify communication destinations even when traditional identification methods fail due to obfuscation or unknown destinations
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
An information processing apparatus (10) includes a virtual machine (30) that analyzes behavior of malware and a virtual machine (40) that transfers transmission information transmitted thereto from the virtual machine (30). The virtual machine (30) includes a shadow memory (34b), a shadow disk (35b), and a virtual NIC (36). The virtual machine (40) includes a guest OS (42). The shadow memory (34b) and the shadow disk (35b) each store therein pieces of data and pieces of tag information assigned to the pieces of data, so as to be kept in correspondence with one another. When malware transmits data, the virtual NIC (36) generates the transmission information containing the transmitted data and tag information assigned to the transmitted data and further transmits the generated transmission information to the virtual machine (40). The guest OS (42) extracts the tag information from the received transmission information. Further, the guest OS (42) determines a transfer destination of the transmission information on the basis of the extracted tag information and further transfers the transmission information to the determined transfer destination.