Behavioral Sandbox for Dynamic Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security technologies face challenges in distinguishing between legitimate and malicious software applications, particularly with the increasing use of plug-in components and run-time interpreted code, which can lead to compromised systems due to inflexible sandboxing solutions that lack dynamic determination of sandboxed portions and resource shielding.
Innovation Solution
The implementation of behavioral sandboxing, which uses behavioral analysis to determine when a process should be run within a sandbox execution environment and monitors applications to dynamically adjust the execution environment, allowing only safe operations to proceed outside the sandbox, while restricting potentially malicious activities within the sandbox.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional sandboxing is used to protect from malicious software, then system security is improved, but application functionality and user experience deteriorate due to overly restrictive execution environments
Solution Approach 1:
The system dynamically determines the sandboxing scope based on behavioral analysis of the application. The sandbox execution environment is not static but adapts its restrictions based on real-time monitoring of application behavior, allowing legitimate operations while containing potentially harmful actions.
Solution Approach 2:
The patent applies sandboxing selectively to specific portions of applications based on their behavioral characteristics. Instead of uniformly sandboxing entire applications, the system identifies and restricts only the problematic components or code sections that exhibit malicious behavior, allowing the rest of the application to function normally.
2Measurement precision
If behavioral analysis is performed on all executable applications, then detection accuracy of malicious software is improved, but system performance and processing time deteriorate
Solution Approach 1:
The system performs behavioral analysis to a sufficient degree rather than exhaustive analysis. It monitors key behavioral characteristics and stops analysis when enough information is gathered to make a determination, avoiding unnecessary continued monitoring of benign applications while maintaining high detection accuracy for malicious ones.
Solution Approach 2:
The behavioral analysis is segmented into different levels or phases. The system performs initial analysis on specific behavioral characteristics and can escalate to more comprehensive monitoring only when suspicious patterns are detected, distributing the analysis workload efficiently.
3Reliability
If the sandbox execution environment is highly restrictive, then protection from malicious operations is improved, but legitimate application operations deteriorate due to false positives
Solution Approach 1:
The system continuously monitors application behavior within the sandbox and uses feedback from this monitoring to adjust the sandbox restrictions. When legitimate operations are blocked, the system learns from this feedback and modifies the sandbox environment to allow these operations, reducing false positives while maintaining security.
Solution Approach 2:
The system performs preliminary behavioral analysis before fully restricting an application in the sandbox. By analyzing behavioral characteristics in advance, the system can configure the sandbox environment to be restrictive enough to block malicious operations but permissive enough to allow legitimate operations, avoiding false positives from the start.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and system for behavioral sandboxing are described. In one example embodiment, a system for behavioral sandboxing can include a network and a computer. The network communicatively coupled to a source of an executable application. The computer communicatively couple to the network and including a behavioral analysis module and a plurality of execution environments. The behavioral analysis module is configured to perform behavioral analysis on the executable application downloaded over the network. The plurality of execution environments including a standard execution environment and a protected execution environment. The behavioral analysis module is configured to evaluate a plurality of behavioral characteristics of the executable application to determine whether the executable application should be executed within the protected execution environment prior to execution of the executable application. The behavioral analysis module also monitors execution of the executable application to determine whether the execution environment can be changed.