Static approach to identify junk APIs in a malware
View Patent ↗A method for identifying malware is provided. The method includes performing a static analysis of a plurality of files and for each file of the plurality of files, determining in the static analysis whether the file includes an application programming interface (API). For each file, of the plurality of files, found to have an application programming interface, the method includes determining in the static analysis whether the application programming interface is proper in the file and alerting regarding an improper application programming interface when found in one of the plurality of files. A scanner for detecting malware is also provided.
1. A method, performed by at least one processor, for identifying malware, comprising:
performing a static analysis on each of a plurality of files;
for each file of the plurality of files, determining in the static analysis whether the file includes code with an application programming interface (API) call;
for each file, of the plurality of files, found to include code with an API call, determining in the static analysis whether the API call is a junk API call, the determining including determining whether the API call returns an output value that is discarded and never used in any subsequent operation except storing the output value in a storage operation by writing the output value to a register of a processor but the code of the file subsequently overwriting the register of the processor; and
alerting regarding one or more junk API calls found in one of the plurality of files.
2. The method of claim 1 , wherein the determining of whether the API call is a junk API call further includes comparing a size of code or data of the API call to an expected size of code or data according to a specification regarding the API.
3. The method of claim 1 , wherein the determining of whether the API call is a junk API call further includes determining whether the file includes a further API call expected as support for the API call found in the file, according to a specification regarding the API.
4. The method of claim 1 , wherein the determining of whether the API call is a junk API call further includes determining whether the API call has at least an expected minimum number of input parameters according to a specification regarding the API.
5. The method of claim 1 , wherein the determining of whether the API call is a junk API call further includes determining whether the API call has a correct number or type of parameter values according to a specification regarding the API.
6. The method of claim 1 , wherein the static analysis excludes emulation.
7. A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:
detecting, using static analysis, an application programming interface (API) call in code of a file;
determining, using the static analysis, that the API call is a junk API call, the determining including determining whether the API call returns an output value that is discarded and never used in any subsequent operation except storing the output value in a storage operation by writing the output value to a register of a processor but the code of the file subsequently overwriting the register of the processor; and
indicating that the file includes suspected malware, based on the determining.
8. The computer-readable media of claim 7 , wherein the determining that the API call is a junk API call further includes determining that an import size of the API call is less than an expected size, according to information in a data structure.
9. The computer-readable media of claim 7 , wherein the determining that the API call is a junk API call further includes determining that the file lacks a supporting API call that is expected for the API call detected in the file, according to information in a data structure.
10. The computer-readable media of claim 7 , wherein the determining that the API call is a junk API call further includes determining that the API call has fewer input parameters than expected, according to information in a data structure.
11. The computer-readable media of claim 7 , wherein the determining that the API call is a junk API call further includes determining that the API call has at least one input parameter with an invalid value, according to information in a data structure.
12. The computer-readable media of claim 7 , wherein the method further comprises:
rating, using the static analysis, the API call and usage of the API call in the file as to compliance to specification information regarding APIs, wherein the determining is based on the rating.
13. A scanner for malware detection, comprising:
a microprocessor;
an input/output (I/O) module configured to access a plurality of files; and
a malware detection engine, configured to perform a static analysis on each of the plurality of files including:
detecting one or more API calls in code of the file;
determining whether each of the one or more API calls in the file is a junk API call, the determining including determining whether the API call returns an output value that is discarded and never used in any subsequent operation except storing the output value in a storage operation by writing the output value to a register of a processor but the code of the file subsequently overwriting the register of the processor, based on specification information regarding APIs; and
indicating suspected malware upon determining that at least one of the one or more API calls in the file is a junk API call not in accordance with the specification information.
14. The scanner of claim 13 , wherein:
the malware detection engine has a code lines analyzer configured to analyze lines of code of the file; and
the detecting and the determining are performed in cooperation with the code lines analyzer.
15. The scanner of claim 13 , wherein:
the malware detection engine has an API detector configured to perform the detecting;
the malware detection engine has an API analyzer configured to cooperate with the API detector and configured to perform the determining; and
the API analyzer is configured to access at least one data structure that includes or references the specification information and is included in the scanner, coupled to the scanner, or remote from the scanner.
16. The scanner of claim 13 , wherein:
the malware detection engine is configured to rate the file as to at least one of:
import size of code or data of the one or more API calls in comparison with the specification information;
presence or absence of a further API call in case the further API call is expected, according to the specification information, to support the one or more API calls in the file;
number of input parameters of the one or more API calls in comparison with the specification information;
validity of parameter values of the one or more API calls relative to the specification information; or
use, in code of the file, of parameter values returned by the one or more API calls; and
the determining that at least one of the one or more API calls in the file is a junk API call not in accordance with the specification information is further based on the rating.
17. The scanner of claim 13 , wherein:
the malware detection engine has an alert module configured to communicate the indicating suspected malware via the I/O module, using one of: a message, a flag, or writing to a data structure.