File Analysis System Using Virtual Machine Configuration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting harmful files are ineffective for analyzing files of different formats, particularly due to vulnerabilities in popular programs like Adobe Reader and the increasing prevalence of non-executable file formats such as PDF and SWF, which can contain malicious scripts and resources.
Innovation Solution
A system and method that determines the format of a suspicious file, using antivirus software for initial analysis and selecting a virtual machine configuration based on the file format for further analysis, which includes opening the file with a corresponding program, simulating user actions, and registering system API calls and memory dumps to determine if the file is harmful, generating a signature for harmful files and updating a collection of signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus software is used for analyzing files, then executable file detection is effective, but detection of non-executable file formats (PDF, SWF) is ineffective
Solution Approach 1:
The system makes the antivirus analysis capability universal by supporting multiple file formats (executable files, PDF, SWF, and others) through a unified analysis architecture. The virtual machine environment can execute different types of files natively, allowing the same antivirus engine to detect malware across diverse formats without requiring format-specific detection mechanisms.
Solution Approach 2:
A virtual machine is introduced as an intermediary between the suspicious file and the antivirus analysis system. The virtual machine provides a controlled execution environment that can handle various file formats natively, allowing the antivirus software to analyze files indirectly through the VM's execution behavior, thereby extending detection capability to non-executable formats.
2Reliability
If virtual machine analysis is used for all files, then detection capability for non-executable formats is improved, but analysis time increases
Solution Approach 1:
The system applies partial action by using virtual machine analysis selectively rather than for all files. Antivirus software first performs quick signature-based scanning, and only files that pass this initial check or are suspected to be in non-executable formats are subjected to the more time-consuming virtual machine analysis, thus reducing overall analysis time while maintaining detection capability.
Solution Approach 2:
The analysis process is segmented into two stages: a fast initial scan using traditional antivirus methods for all files, followed by a deeper virtual machine analysis only for suspicious or non-executable files. This segmentation allows the system to maintain high detection capability for complex files while minimizing time loss for the majority of benign files.
3Measurement precision
If virtual machine configuration is customized based on file format, then detection precision is improved, but system complexity increases
Solution Approach 1:
The system changes parameters (virtual machine configuration) based on the file format being analyzed. Different file formats are associated with specific virtual machine configurations (e.g., PDF files are analyzed in a VM configured with Adobe Reader, SWF files with a browser plugin, etc.). This parameter adaptation allows precise detection for each format while managing complexity through automated configuration selection based on file type identification.
Data Source
AI summary
Disclosed are systems, methods and computer program products for detection of harmful files of different formats. An example method includes determining a suspicious file and a file format of the suspicious file; analyzing the suspicious file by an antivirus software to determine whether the suspicious file is clean or harmful; when the suspicious file is determined to be harmful by the antivirus software, generating a signature of the suspicious file and updating a collection of harmful files with the signature of the suspicious file; and when the suspicious file is not determined to be clean or harmful by the antivirus software, selecting, based on at least the file format of the suspicious file, a configuration of a virtual machine for analysis of the suspicious file, and analyzing the suspicious file by the virtual machine with selected configuration to determine whether the suspicious file is clean or harmful.