Juniper Networks, Inc.
Detecting malware concealed by delay loops of software programs

Abstract:

A device receives a software program with potential malware and a loop to conceal the potential malware, and processes the software program, with a loop identification technique, to identify the loop in the software program. The device modifies, with a loop exit technique and based on data from the loop identification technique, the software program to exit the loop, and processes the software program, with a malware detection technique and after modifying the software program to exit the loop, to determine whether the software program contains malware. The device causes one or more actions to be performed based on a result of processing the software program with the malware detection technique.