Taint Tag Malware Routing for Safe Dynamic Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional methods for dynamically analyzing malware struggle to analyze behavior without harming other parties, particularly when communication destinations are unknown or payloads are obfuscated, as they rely on IP addresses and communication payloads for switching between real and simulating Internet networks.

Innovation Solution

An information processing system that includes a simulating Internet apparatus, a real Internet connection apparatus, and a malware communication destination switching apparatus, which uses taint tags to determine whether data should be transmitted over a real or simulating Internet network, allowing precise switching based on taint tags assigned to data in the malware execution environment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional dynamic analysis methods are used to track malware behavior, then malware functions can be analyzed, but it becomes difficult to prevent harm to other parties when malware communicates with unknown destinations or uses obfuscated payloads

Engineering Contradiction:
Improveaccuracy of malware behavior analysisVSAvoidharm to third parties
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a communication destination switching apparatus that acts as an intermediary between the malware execution environment and the real Internet network. This apparatus monitors communication requests, checks for taint tags in data, and routes traffic appropriately - blocking harmful communications while allowing legitimate analysis to proceed, thus preventing harm to third parties without compromising analysis accuracy

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary actions by assigning taint tags to sensitive data before malware execution. The communication destination switching apparatus is pre-configured to monitor and control communication destinations. This preliminary setup enables the system to proactively identify and block harmful communications before they reach third parties, rather than reacting after damage occurs

Inventive Principle:
Principle #10Preliminary action

2Adaptability or versatility

If switching between real and simulating Internet networks is based on IP addresses and communication payloads, then communication can be routed appropriately, but the system cannot handle unknown destinations or obfuscated payloads effectively

Engineering Contradiction:
Improveflexibility in communication routingVSAvoidaccuracy of communication destination identification
Core Design Contradiction:
Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent replaces the conventional mechanical approach of matching IP addresses and payload patterns with a data-driven taint tag system. Instead of relying on identifiable communication characteristics that can be obfuscated, the system uses invisible tags embedded in the data itself, making the routing mechanism independent of payload content and destination address visibility

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system changes the fundamental parameter used for communication routing from external identifiers (IP addresses, payload patterns) to internal data attributes (taint tags). This parameter change enables the system to accurately identify communication destinations even when traditional identification methods fail due to obfuscation or unknown destinations

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP3139298B1Information processing system, control method, and control program
Publication Date: 2019.10.16 NIPPON TELEGRAPH & TELEPHONE CORP
  • EP3139298B1 patent drawingFigure 1
  • EP3139298B1 patent drawingFigure 2
  • EP3139298B1 patent drawingFigure 3~4

AI summary

An information processing apparatus (10) includes a virtual machine (30) that analyzes behavior of malware and a virtual machine (40) that transfers transmission information transmitted thereto from the virtual machine (30). The virtual machine (30) includes a shadow memory (34b), a shadow disk (35b), and a virtual NIC (36). The virtual machine (40) includes a guest OS (42). The shadow memory (34b) and the shadow disk (35b) each store therein pieces of data and pieces of tag information assigned to the pieces of data, so as to be kept in correspondence with one another. When malware transmits data, the virtual NIC (36) generates the transmission information containing the transmitted data and tag information assigned to the transmitted data and further transmits the generated transmission information to the virtual machine (40). The guest OS (42) extracts the tag information from the received transmission information. Further, the guest OS (42) determines a transfer destination of the transmission information on the basis of the extracted tag information and further transfers the transmission information to the determined transfer destination.