InetCop Files Patent for "Application Detection Method and Device for Virtualization Protection Technique"

InetCop announced on the 13th that it had filed a patent for the technology titled "Application Detection Method and Device for Virtualization Protection Technique." A CI for InetCop (photo: InetCop) was also provided.

The patent filing responds to the rising number of voice phishing malicious apps. Some voice phishing malicious apps apply a "code virtualization protection technique" to evade detection by security solutions, and InetCop has developed a technology to counter it.

Code virtualization is a concept that converts application execution code into a form that a dedicated interpreter can decode. When code virtualization is applied, only the names of functions, which are the units that carry out each task, remain in the core code area, while the malicious code itself does not remain. Because traditional static analysis methods are based on inspecting code content, apps with code virtualization applied are difficult to detect through conventional static analysis.

Accordingly, InetCop did not adopt a method of restoring or interpreting the virtualized code, but instead chose a method that analyzes the structural characteristics of the app. This approach determines whether a protection technique has been applied by checking the normal proportional relationship between the number of functions declared in the execution code area and the file size of that area.

It then proceeds with a follow-up procedure to inspect areas excluded from virtual protection. The purpose is to secure evidence of maliciousness.

The company said the method takes advantage of the structural imbalance in malicious apps to which the virtualization protection technique has been applied. It added that this makes it possible to determine whether the app is malicious without a complex dynamic analysis process.

InetCop CEO Yoo Dong-hoon said this approach is not bound to the malicious types designed by attackers. He also said the reverse approach of digging into the app's own structural contradictions is the core of this patent, and added that he expects it to contribute to preventing increasingly sophisticated voice phishing crimes.

The technology was introduced as an outcome of a project funded by the Ministry of Science and ICT. It was also described as a result of the "Development of Technology to Detect and Predict Unknown New-Type Voice Phishing" project (RS-2025-02263169), carried out with support from the Institute of Information & Communications Technology Planning & Evaluation (IITP).

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242920

References

• https://www.itdaily.kr/news/articleView.html?idxno=242920