Dynamic Embedded Object Analysis in Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems have difficulty detecting embedded objects within documents, often resulting in false negatives and false positives due to the inability to fully analyze the maliciousness of embedded objects, especially when they are not visible on the default view of a document, such as in a large PDF file.
Innovation Solution
A threat detection platform that employs dynamic and static analysis using virtual machine instances to launch and process embedded objects within a virtual runtime environment, employing an automation framework interface to query the document object model and determine the maliciousness of embedded objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If current malware detection systems analyze only the default view of document objects, then analysis time is reduced, but embedded objects located beyond the default view are not detected
Solution Approach 1:
The system performs preliminary action by launching the document object in a virtual machine environment before full analysis, allowing embedded objects to be dynamically extracted and analyzed without manually navigating through all pages. The virtual machine automatically executes the document and extracts embedded objects for subsequent malware detection analysis.
Solution Approach 2:
A virtual machine instance serves as an intermediary between the document object and the malware detection system. The virtual machine launches and processes the document object, extracting embedded objects that would otherwise be inaccessible, thereby enabling the detection system to analyze content beyond the default view without direct human intervention.
2Productivity
If embedded objects are not processed beyond mere presence detection, then detection speed is maintained, but false negatives occur when embedded objects contain malware
Solution Approach 1:
The detection process is segmented into distinct phases: initial presence detection, dynamic extraction of embedded objects, and separate malware analysis of extracted objects. This segmentation allows the system to quickly identify documents containing embedded objects while maintaining thorough analysis capabilities for reliability without sacrificing overall detection speed.
Solution Approach 2:
The system performs preliminary extraction of embedded objects during the document analysis phase, preparing them for subsequent malware detection. This preliminary action ensures that when embedded objects are detected, they are already isolated and ready for rapid malware analysis, maintaining detection speed while improving reliability.
3Measurement precision
If embedded objects are fully analyzed for maliciousness, then detection accuracy is improved, but analysis time and computational resources increase
Solution Approach 1:
The system extracts embedded objects from their parent document containers and analyzes them as separate, independent entities. This extraction allows focused malware detection on only the embedded objects that pose potential threats, rather than re-analyzing the entire document structure, thereby improving detection accuracy while controlling analysis time.
Solution Approach 2:
The virtual machine creates a copy of the embedded object for analysis while the original remains in the document structure. This copying approach allows thorough malware analysis of the embedded object without permanently altering or slowing down the processing of the original document, maintaining detection accuracy while managing analysis time.
4Reliability
If embedded objects are detected and processed, then false positives are reduced, but system complexity increases due to virtual machine requirements
Solution Approach 1:
The virtual machine instance serves multiple functions: it launches document objects, extracts embedded objects, provides a sandboxed execution environment, and enables malware detection analysis. This multi-functionality reduces the need for separate specialized systems, thereby improving detection reliability while managing overall system complexity through a unified platform.
Data Source
AI summary
According to one embodiment, a threat detection platform is integrated with at least one virtual machine that automatically performs a dynamic analysis of a received document object and monitors the processing during the dynamic analysis. The dynamic analysis includes a detection of embedded objects and may automatically process the embedded objects, while maintaining a context of the embedding, within the virtual machine processing the document object. The virtual machine may monitor the processing of both the document object and the embedded object. The results of the processing may be analyzed to determine whether the document object includes malware and/or a threat level of the document object.