Dynamic Isolated Execution Environment for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious applications in computer systems face challenges in selecting appropriate emulation environments, particularly for partially encrypted or obfuscated applications, which can lead to incomplete or insecure analysis.
Innovation Solution
A method and system for generating and modifying isolated execution environments using constraint generation rules from a database, allowing for the analysis of applications by identifying necessary conditions for correct execution and adjusting the environment accordingly to check for malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a sandbox is used to execute applications for analysis, then the application can be executed in a controlled environment, but not all sandboxes allow a given application to run and it is difficult to emulate exactly the resources needed
Solution Approach 1:
The patent implements dynamic environment generation where the sandbox configuration is automatically adjusted based on the detected launch conditions of the application. The system monitors execution and modifies the environment constraints in real-time to maintain correct application behavior, resolving the contradiction between reliable execution and environmental adaptability.
Solution Approach 2:
The system changes execution environment parameters dynamically by generating and modifying constraint sets based on observed application behavior. When incorrect execution is detected, the system modifies environment parameters (resources, permissions, configurations) to achieve correct execution, thereby improving both reliability and adaptability.
2Ease of operation
If manual selection of sandboxes is used, then the selection process is simple, but it does not allow selection for unknown applications due to safety concerns
Solution Approach 1:
The system performs self-service by automatically detecting launch conditions and generating appropriate sandbox configurations without manual intervention. The analysis system autonomously selects and configures the execution environment based on the application's requirements, maintaining both ease of operation and safety for unknown applications.
Solution Approach 2:
The system performs preliminary analysis of the application to detect launch conditions before execution. By pre-identifying the necessary environment constraints and generating appropriate sandboxes in advance, the system ensures safe and automated selection without manual intervention, resolving the contradiction between operational ease and safety.
3Reliability
If the execution environment is strictly controlled for security, then malicious code detection is improved, but the application may not execute correctly due to restricted resources
Solution Approach 1:
The system implements feedback mechanisms where execution results are monitored and used to adjust environment constraints. When incorrect execution is detected, the system receives feedback about the execution errors and modifies the sandbox configuration accordingly, balancing security control with execution correctness to maintain both detection accuracy and operational correctness.
Solution Approach 2:
The execution environment constraints are made dynamic rather than static. The system adjusts the level of control and available resources based on real-time execution monitoring, allowing strict control when needed for security and relaxed control when necessary for correct execution, thereby resolving the contradiction between detection accuracy and execution correctness.
Data Source
AI summary
Disclosed herein are systems and methods for modifying execution environments of applications. In one aspect, an exemplary method comprises, identifying an application that requires an isolated execution environment in order to be analyzed, generating an isolated execution environment to launch the identified application using constraint generating rules from a rules database, launching the application in the isolated execution environment that was generated, when an incorrect execution of the application is detected after the application is launched in the isolated execution environment, stopping the execution of the application and modifying the isolated execution environment using the constraint generating rules from the rule database, and when an incorrect execution of the application is not detected after the application is launched in the isolated execution environment, checking for a presence of a malicious code in the application running in the modified isolated execution environment.