Backup File Selection for Cloud Sandbox Malware Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malware in client machines are inefficient and costly, as they often require full system scans that degrade performance and utilize cloud resources wastefully by analyzing non-malicious files.
Innovation Solution
A system that uses static analysis techniques on client backup files to select a subset of files for dynamic analysis in cloud sandboxes, employing AI models and configurable thresholds to minimize resource usage and performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files on a client machine are continuously scanned using cloud resources, then malware detection capability is improved, but cloud resource cost and processing overhead increase significantly
Solution Approach 1:
The patent segments the file analysis process into two distinct phases: static analysis (performed on backup files to identify suspicious files) and dynamic analysis (performed only on selected suspicious files in cloud sandboxes). This segmentation allows the system to filter out non-malicious files before expensive dynamic analysis, thereby reducing cloud resource consumption while maintaining detection capability.
Solution Approach 2:
Instead of performing full dynamic analysis on all files, the patent applies partial action by conducting static analysis on all backup files first, then performing dynamic analysis only on the subset of files that exceed the maliciousness threshold. This partial approach to dynamic analysis significantly reduces resource usage while still detecting malware.
2Reliability
If full system scans are conducted frequently on client machines, then proactive malware detection is improved, but client machine performance and user experience degrade
Solution Approach 1:
The patent analyzes backup files (copies of client machine files) instead of the actual running files on the client machine. This allows comprehensive malware detection analysis to be performed on the backup copies without interfering with the client machine's operational performance or user experience.
Solution Approach 2:
The system segments the analysis workload by performing static analysis locally or on backup files before cloud submission, and only submitting suspicious files for dynamic analysis. This segmentation reduces the performance impact on client machines compared to continuous full system scans.
3Measurement precision
If static analysis thresholds are lowered to increase detection sensitivity, then malware detection accuracy is improved, but the number of files requiring dynamic analysis increases
Solution Approach 1:
The patent employs configurable maliciousness thresholds that can be adjusted to balance detection sensitivity with resource consumption. By changing the threshold parameter, the system can adapt to different operational requirements - higher thresholds reduce false positives and dynamic analysis workload, while lower thresholds increase detection sensitivity at the cost of more files requiring dynamic analysis.
Data Source
AI summary
Disclosed herein are systems and methods for selecting files for malware analysis. In one aspect, a method may include identifying, in a cloud network, a backup of a client machine; extracting, from the backup, at least one file of a given file type; determining whether to include the at least one file in a sandbox of the cloud network by performing a static analysis of the at least one file; selecting the at least one file for inclusion in the sandbox based on the static analysis; monitoring, for a period of time, a behavior of the at least one file in the sandbox by performing a dynamic analysis of the at least one file; and in response to determining that the at least one file is malicious based on the dynamic analysis, performing a remediation action on the at least one file.