Virtual Imitating Resource for Evasive Malware Deactivation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Advanced evasive malware can detect and cloak its malicious behaviors when running in analysis environments, making it difficult for security systems to generate signatures for detection, as over 80% of malware exhibits evasive behaviors, and existing methods are ineffective against such malware.
Innovation Solution
Deploying a virtual imitating resource system that deceives evasive malware into believing it is running in an analysis environment, thereby triggering it to disable its malicious activities by mimicking analysis environment-related resources and returning crafted responses to system calls, effectively stopping malicious behavior on physical hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware analysis sandboxes are used to detect malware behaviors, then security detection capability is improved, but evasive malware can detect the analysis environment and cloak its malicious behaviors, making detection ineffective
Solution Approach 1:
Instead of trying to detect malware's evasion techniques directly, the patent inverts the approach by having the system pretend to be an analysis environment. Virtual imitating resources are deployed to mimic sandbox characteristics, causing evasive malware to believe it is being analyzed and thereby expose its malicious behaviors for detection
Solution Approach 2:
The patent introduces virtual imitating resources as an intermediary between the malware and the real analysis environment. These virtual resources act as a mediator that presents fake analysis environment characteristics to the malware, allowing the system to study malware behavior without exposing the actual analysis infrastructure
2Reliability
If virtual imitating resources are deployed to deceive evasive malware, then malware deactivation effectiveness is improved, but system complexity increases due to installation and configuration of virtual resources
Solution Approach 1:
The patent creates virtual imitating resources that serve multiple functions: they mimic analysis environment characteristics, respond to malware system calls, and can be dynamically configured. These universal virtual resources can handle various types of evasive malware without requiring separate specialized components for each threat type
Solution Approach 2:
The patent employs dynamic imitating resources whose characteristics can be changed by modifying parameters such as call graph patterns and resource behavior. This allows the virtual resources to adapt to different malware evasion techniques without requiring complete reconfiguration of the system architecture
Data Source
AI summary
A computer-implemented method, a computer program product, and a computer system. The computer system installs and configures a virtual imitating resource in the computer system, wherein the virtual imitating resource imitates a set of resources in the computer system. Installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, and comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database. The computer system returns a response from an appropriate element of the virtual imitating resource, in response to a call from the evasive malware to a real computing resource, return, by the computer system.