Dynamic OS-Level Containerization for Unknown Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems are limited in detecting unknown malware, as they primarily rely on signature-based detection methods and fail to identify malicious software that has not been previously recognized.
Innovation Solution
Implementing dynamic operating-system-level containerization, where a computer file is scanned using anti-malware, and if unknown malware is suspected, an isolated container is created to mimic different system configurations, allowing the malware to be executed and monitored within a controlled environment, enabling detection of unknown malicious patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based anti-malware scanning is used, then known malware can be detected efficiently, but unknown malware cannot be detected
Solution Approach 1:
The system segments malware detection into two distinct phases: (1) signature-based scanning for known malware patterns, and (2) behavioral analysis within isolated containers for unknown malware. This segmentation allows each method to specialize in what it does best while working together comprehensively.
Solution Approach 2:
Isolated containers serve as an intermediary environment between the host system and potentially malicious files. The container acts as a safe mediator that allows execution of suspicious files without direct access to the host, enabling behavioral observation while protecting the system.
2Reliability
If isolated containers are created to execute and monitor suspicious files, then unknown malware can be detected, but system resources are consumed
Solution Approach 1:
The system applies partial action by only creating isolated containers when signature-based scanning fails to detect malware. Not every file requires containerized execution - only those flagged as potentially malicious by the initial scan. This selective approach conserves resources while maintaining detection capability.
Solution Approach 2:
The system automatically manages the lifecycle of isolated containers - creating them when needed, monitoring within them, and automatically cleaning up after execution. The containerization mechanism is self-managing, reducing the need for manual resource allocation and cleanup.
3Measurement precision
If multiple isolated containers are created to mimic different system configurations, then malware behavior can be better analyzed, but device complexity increases
Solution Approach 1:
The isolated container system is designed to be universal, with a single container infrastructure that can be configured to mimic different system environments. Rather than creating specialized container types for each scenario, the system uses one flexible platform that can adapt to various configuration needs through parameter settings.
4Reliability
If executable files are monitored in isolated containers, then malicious execution patterns can be detected, but processing time increases
Solution Approach 1:
The system monitors only the essential execution behaviors needed to detect malware patterns, rather than recording every single system call or event. By focusing on key indicators of malicious behavior, the system achieves effective detection while minimizing the time overhead of monitoring.
Data Source
AI summary
A method of protecting a computer from malicious software includes receiving a computer file, and scanning, via anti-malware, the computer file for known malicious software. The method include, when the anti-malware fails to detect known malicious software in the computer file, performing a dynamic operating-system-level containerization to access content of the computer file, including creating and launching an isolated container on the computer. The method includes accessing the content of the computer file in the isolated container on the computer, and monitoring execution of computer-readable program code in the isolated container as the content of the computer file is accessed. And the method includes performing a remedial action when as the execution of computer-readable program code in the isolated container is monitored, a pattern in the execution is detected that indicates the computer file contains malicious software that is otherwise unknown.