Cloud Sandbox Malware Detection with AI and Image Keywords
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection methods, such as static or signature-based analysis, struggle to identify stealthy malware, including zero-day, novel, and polymorphic malware embedded in everyday office documents, which often initiate attacks and are difficult to detect.
Innovation Solution
A cloud-based network security system uses a sandbox to detonate documents, analyzing static and dynamic information, and employs AI models to predict malware presence, combined with heuristic analysis of character strings from images, to classify documents as malicious or clean.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static or signature-based detection methods are used, then the detection process is simple and fast, but the detection accuracy for stealthy malware including zero-day and polymorphic malware is insufficient
Solution Approach 1:
The patent introduces a sandbox environment as an intermediary between the malware sample and the detection system. The sandbox isolates the malware execution, allowing dynamic analysis of malware behavior without compromising the host system. This mediator enables the collection of behavioral features (system calls, registry changes, file modifications) that significantly improve detection accuracy for stealthy and zero-day malware while maintaining system safety.
Solution Approach 2:
The detection system is segmented into multiple independent components: static analysis module, dynamic analysis module in sandbox, feature extraction module, and classification module. Each component performs a specific function, allowing the system to handle complex malware detection tasks through coordinated simple modules. This segmentation improves detection accuracy while keeping individual components manageable in complexity.
2Measurement precision
If dynamic analysis in sandbox is performed, then malware detection accuracy improves, but the analysis time and processing duration increase
Solution Approach 1:
The system performs preliminary static analysis on malware samples before executing them in the sandbox. This preliminary action extracts basic features (file headers, code patterns, metadata) that can immediately identify many malware samples without time-consuming dynamic execution. For samples that pass the static analysis filter, dynamic analysis is then performed, significantly reducing the overall analysis time while maintaining high detection accuracy.
Solution Approach 2:
The system implements a tiered analysis approach where not all documents undergo full dynamic sandbox analysis. Instead, documents are first screened using lighter static analysis methods. Only documents that exhibit suspicious characteristics during static analysis proceed to full dynamic analysis. This partial action approach reduces the average processing time while maintaining high detection accuracy for malicious documents.
Data Source
AI summary
A cloud-based network security system (NSS) is described. The NSS uses a sandbox to safely detonate and extract information about a document and uses machine learning algorithms to analyze the information to predict whether the document contains malicious software. Specifically, during the detonation, static and dynamic information about the document is captured in the sandbox as well as character strings from images in the document. The dynamic information (and sometimes the static information) is input to an AI or machine learning model trained to provide an output indicating a prediction of whether the document contains malware. The character strings are compared with a batch of phishing keywords to generate a heuristic score. A validation engine combines the output from the AI or machine learning model and the heuristic score to classify the document as malicious or clean. Security policies can then be applied based on the classification.