How Anti-Malware Works
Anti-malware protection works in two distinct ways:
- It detects the malicious lines of code within a file
- It needs to isolate or otherwise prevent the file from running
The specific way in which anti-malware detects a suspicious or dangerous file can take a few different forms, with the two potential paths of approach being static and dynamic analyses.
Static Detection
Static malware analysis is a critical technique in the fight against known, file-based malware. It focuses on manually analyzing malware files’ unique features. For suitable in-depth analysis, security practitioners generally rely on multiple copies of each types of malware family, drawn from:
- Online repositories
- The dark web
- Infected computers
Aspects such as file size, imported and exported functions, hashes, and printable strings are all drawn into this static analysis, allowing for an understanding of a malware’s actions that are then collated into shareable signatures.
Signature Formats
Signature formats like YARA play an essential role in this process, letting analysts craft descriptions of malware families and share them with compatible tools. Each YARA rule consists of a set of strings and a boolean expression, enabling precise detection of a code’s nature regardless of the wider context.
This way, it’s possible for malware that has only infected one company to be analyzed and implemented into an entire industry’s defenses.
The effectiveness of signature-based detection depends heavily on the number of malware samples analyzed. When analysts have only a limited set of samples, or even just a single sample, the resulting signature is less effective and far more susceptible to false positives.
Also, quick scanning larger files requires more resources. Although restricting file scans based on size can improve performance, it also opens up a whole new vulnerability in the discovery process: malware authors can exploit this by inflating files with unnecessary code to evade detection.
Dynamic Analysis
An alternative to the static analysis of file signature-scanning is heuristics. This newer approach focuses on analyzing the real-time behavior of files, rather than trying to guess from the raw code. It’s partly a response to advanced threat techniques like:
- Code obfuscation
- Partly a targeted defense against novel malware strains
Heuristics are at the heart of user and entity behavior analytics (UEBA): when applied to a wider organization, UEBA relies on algorithms to study the behavior of users, routers, endpoints, and servers.
Dynamic Heuristic Analysis and UEBA
But before UEBA, dynamic heuristic analysis relied on a sandbox. It is within this isolated, cordoned-off section of the runtime environment that a copy of the suspect file is executed.
Its activities are then tracked. If the file begins rifling through system logs, trying to establish connections to an unknown server, or otherwise misbehaving – the anti-malware program tags it as malicious, terminates it, and prevents its download onto company devices.
But in the endless cat-and-mouse of cybersecurity, some attackers worked out that their malicious files could first run a check. Establishing whether they’re likely in a sandbox or not, an increasing number of advanced malware strains now refuse to run if they detect a completely-empty or newly-created environment.
This leads us to the most advanced form of anti-malware: UEBA.
Feedback