Hypervisor Memory Artifact Analysis for Malware Evasion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques are inadequate in identifying malicious files that employ sandbox evasion techniques, such as forced crashes, limiting the effectiveness of static and dynamic analysis methods.
Innovation Solution
A system and method for detecting malicious files using dynamic analysis in a virtual environment, monitoring memory-use artifacts like API pointers, API vectors, page permission modifications, and OS structure changes to generate feature vectors for machine learning-based classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static and dynamic analysis methods are used to detect malware, then malware detection capability is improved, but malware can evade detection using sandbox evasion techniques such as forced crashes
Solution Approach 1:
The patent implements dynamic monitoring of memory artifacts during malware execution in a virtualized environment. The system continuously tracks changes in API pointers, API vectors, page permissions, and OS structure modifications throughout the malware lifecycle, enabling detection of evasion techniques that occur during runtime rather than relying solely on static analysis or limited dynamic snapshots.
Solution Approach 2:
The patent introduces a new dimension of analysis by monitoring memory artifacts at the hypervisor level rather than within the guest OS. This external perspective allows the system to observe malware behavior from a higher abstraction layer, capturing artifacts that malware attempts to hide within the sandboxed environment, thereby adding a dimensional advantage to detection capabilities.
2Measurement precision
If comprehensive dynamic analysis is performed to detect evasion techniques, then detection accuracy is improved, but analysis time and computational resources increase
Solution Approach 1:
The patent segments the detection process into distinct monitoring components that track specific types of memory artifacts: API pointer changes, API vector modifications, page permission alterations, and OS structure changes. This segmentation allows the system to focus computational resources on specific artifact types and enables parallel processing of different artifact categories, improving both accuracy and efficiency.
Solution Approach 2:
The patent performs preliminary monitoring and collection of memory artifacts during malware execution before final classification occurs. By continuously gathering artifact data throughout the malware lifecycle and preparing feature vectors in advance, the system reduces the computational burden during the actual detection decision-making process, thereby reducing analysis time while maintaining high detection accuracy.
3Measurement precision
If machine learning models are trained on execution artifacts to improve malware classification, then classification accuracy is improved, but model training complexity and data processing requirements increase
Solution Approach 1:
The patent extracts specific, high-value features from the collected memory artifacts that are most indicative of malware behavior. Rather than using all raw artifact data for training, the system identifies and extracts key features such as specific API pointer patterns, API vector sequences, page permission change patterns, and OS structure modification signatures. This feature extraction reduces the dimensionality of training data while preserving the most discriminative information, thereby improving classification accuracy without proportionally increasing model training complexity.
Data Source
AI summary
The present application discloses a method, system, and computer system for detecting malicious files. The method includes executing a sample in a virtual environment, and determining whether the sample is malware based at least in part on memory-use artifacts obtained in connection with execution of the sample in the virtual environment.