Automated Malicious Code Collection via Multi-Level Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate for rapidly detecting and collecting malignant codes, such as exploit codes, disseminated through websites, as they often evade detection due to code obfuscation and dynamic changes, leading to passive information collection that fails to keep pace with the generation and dissemination of these threats.
Innovation Solution
An automatic malignant code collecting system that uses virtual machines at different security levels to actively and frequently scan websites, collect evidence of malicious activity, and store information in a database, enabling rapid identification and mitigation of malignant code threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If passive information collection methods are used (sharing information with relevant organizations or relying on users' reports), then the system operation is simple, but the productivity of collecting malignant code information is low and cannot keep pace with the generation and dissemination of malignant codes
Solution Approach 1:
The system performs preliminary actions by proactively and periodically accessing target websites to collect malignant codes before they can disseminate widely. The automated collection system is set up in advance to continuously monitor and gather code samples, eliminating the need to wait for passive user reports or external information sharing.
Solution Approach 2:
The system serves itself by automatically collecting malignant codes without requiring external input from users or other organizations. The automated web browser periodically accesses target websites, detects malignant codes, and stores them in the database independently, making the collection process self-sufficient and highly productive.
2Reliability
If code obfuscation and dynamic changes are applied to exploit codes, then the malignant code can evade detection and protect itself, but the difficulty of detecting and measuring the code increases
Solution Approach 1:
The system creates copies of malignant codes by periodically accessing target websites and collecting code samples. Multiple copies are stored in the database, allowing analysts to study the code without risking exposure to the original obfuscated version. This copying approach maintains detection reliability while avoiding the pitfalls of direct analysis of obfuscated code.
Solution Approach 2:
The system uses an automated web browser running in a controlled environment as an intermediary to access target websites and collect malignant codes. This intermediary layer allows the system to gather code samples without directly exposing the analysis environment to potentially harmful obfuscated code, reducing detection difficulty while maintaining reliability.
3Productivity
If multiple virtual machines are used to periodically access websites and collect malignant codes, then the productivity of malignant code collection is improved, but the device complexity increases
Solution Approach 1:
The system segments the collection task across multiple virtual machines, with each VM periodically accessing target websites and collecting malignant codes independently. This segmentation increases productivity by parallelizing the collection process while keeping each individual VM relatively simple in structure and operation.
Solution Approach 2:
The virtual machines are designed with multi-functionality, serving as both web browsers for accessing target websites and as collection points for storing malignant codes in the database. This universal design reduces overall system complexity by combining multiple functions into unified components rather than requiring separate specialized systems.
Data Source
AI summary
An automatic malignant code collecting system comprises a first database configured to store detection target website information, a virtual machine controller configured to read the website information from the first database and transmit the website information, a first virtual machine configured to periodically gain access to a website using the website information and to collect a malignant code and evidence thereof if an abnormal event occurs when the first virtual machine gains access to the website, a second virtual machine configured to periodically gain access to the same website as accessed by the first virtual machine using the website information received from the virtual machine controller and to collect a malignant code and evidence thereof if an abnormal event occurs when the second virtual machine gains access to the website, and a second database configured to store the malignant code and the evidence thereof collected by the first virtual machine and the second virtual machine.