Automated Static Analysis vs. Dynamic Analysis - Better Together?

In 2018, 137.5 million new malware samples were created, and 93 percent of those observed were polymorphic, meaning they had the ability to change their code to avoid detection.

Not long ago, many security experts thought they found the secret weapon to detect and eliminate these increasingly sophisticated security threats: Dynamic File Analysis.

By using Dynamic File Analysis to detonate suspicious files in secure sandbox environments, you could analyze their behavior and discover hidden malware; even if a file doesn't contain any known signatures that would indicate the presence of malware, its behavior post-execution would give it away.

And it was a big step forward — but only to a certain extent.

When the Bad Guys Got Smarter, the Malware Got Smarter Too

Dynamic File Analysis is undoubtedly a vital tool for cyber defense, but its utility is decreasing as malware attacks continue to increase in sophistication.

When cybercriminals began to realize their malware was failing due to Dynamic File Analysis, they altered the malware so it would be self-aware of the sandbox environment. For example, if the malware detected a lack of applications or files, it determined it was in a sandbox and did not fire.

Other sandbox evasion techniques include:

• Delayed Malware Execution: Because Dynamic File Analysis within the sandbox environment is time-consuming and security teams can't sit and watch the file for hours on end, hackers program their malware to delay the execution of attacks for a certain period of time or until after a system reboot.
• Password-Protected Attachments: Automated sandbox environments can't open password-protected files for analysis. By hiding malicious code in these attachments, hackers can bypass threat detection.
• Encrypted Traffic: Most organizations don't decrypt incoming traffic. When hackers hide malicious files in encrypted traffic, they can easily bypass the automated detection in sandbox environments.

So how can you combat these advances to better detect and fill the defensive gaps left by existing security tools?

The Solution? Augment Your Existing Security Infrastructure with Automated Static File Analysis

To stay ahead of ever-evolving cybersecurity threats, you need static analysis and more advanced threat-detection capabilities.

Whether or not the files are executable, static analysis enables security teams to decompose and deobfuscate the file and examine the code for malware prior to execution. Traditionally, this process has been exceptionally time-consuming and has required a large, highly-skilled investigative team to complete. However, the latest generation of static analysis uses automation, machine learning and integrations to speed up the process.

Today, security teams can use automated static file analysis tools to reverse-engineer multiple types of files across multiple environments within milliseconds — without alerting the attacker to their efforts. With greater speed and accuracy, security teams can overcome the limitations of Dynamic File Analysis and enhance their overall security posture to cover more threats, more quickly, and more cost-effectively.

Automated Static Analysis tools are purpose-built to overcome the complexity and volatility of today's cybersecurity landscape. Analysts, investigators and threat hunters alike can layer these new tools and processes over their Dynamic File Analysis technology to increase analysis depth and coverage, and bolster their defenses without breaking the bank.

Join the New Malware Defense Paradigm

Yes, Dynamic File Analysis was a groundbreaking technology when it came out — and it is still an incredibly useful tool for threat detection and rapid response.

But hackers are always looking for new loopholes and exploitation techniques to evade threat detection technology. IT security teams have a responsibility to reinforce their existing security processes with the latest, most effective security and analysis solutions to stay ahead of emerging cyber threats.

Combining Dynamic File Analysis and Automatic Static Analysis provides forward-facing security teams with the most sophisticated, multi-layered security protections available.

Read our Blog on The Power of Automated Static Analysis.