Kernel-Mode Virtual Machine File Analysis for Faster Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods in virtual machines are slow, resource-intensive, and prone to failures due to reliance on user mode/kernel mode monitoring, which is easily deceived by malware, and do not effectively address unknown threats.
Innovation Solution
Implementing a zero-trust policy in the kernel mode of a virtual machine to analyze file activities, allowing or denying entry based on customizable organizational policies, without relying on AI or machine learning, and monitoring in a secure, isolated environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user mode/kernel mode monitoring is used for malware detection, then detection capability is provided, but detection speed decreases and resource consumption increases
Solution Approach 1:
The patent extracts the detection logic from the traditional user mode/kernel mode monitoring architecture and implements it directly in the hypervisor. This removes the overhead of mode switching and intermediate monitoring layers, achieving rapid detection while maintaining comprehensive malware detection capability through direct observation of virtual machine activities.
Solution Approach 2:
The hypervisor serves as an intermediary that directly observes and analyzes virtual machine activities without requiring user mode/kernel mode transitions. This intermediary position allows the system to maintain comprehensive monitoring capability while eliminating the performance penalties associated with traditional mode-based monitoring architectures.
2Reliability
If traditional virtual machine monitoring is used, then file execution analysis is provided, but the system is easily deceived by malware and resource consumption increases
Solution Approach 1:
The patent extracts file execution analysis from the guest operating system's user mode and implements it directly in the hypervisor. This eliminates the need for resource-intensive kernel mode monitoring and user mode analysis tools, reducing overall resource consumption while maintaining the ability to detect unknown threats through direct hypervisor-level observation.
Solution Approach 2:
The hypervisor performs self-service file execution analysis by directly observing virtual machine activities without requiring additional monitoring software or mode switching. This self-contained approach reduces resource consumption by eliminating redundant monitoring layers while maintaining comprehensive file analysis capability.
3Ease of operation
If user mode execution with kernel mode monitoring is used, then file execution control is provided, but detection precision decreases due to ease of deception by malware
Solution Approach 1:
The hypervisor acts as a trusted intermediary that directly controls and observes file execution without relying on user mode/kernel mode boundaries that malware can exploit. This intermediary position maintains ease of file execution control while achieving superior detection precision by observing activities at the virtualization layer where malware deception techniques are less effective.
Data Source
AI summary
A method includes receiving, by a computerized system, a file in network traffic to an enterprise system. The computerized system identifies data associated with the file. The computerized system receives a policy based on the data associated with the file for an event of the file. The computerized system executes the file in a user mode of a virtual machine. A driver in a kernel mode of the virtual machine analyzes the event of the file based on the policy during the executing of the file. When the event violates the policy, the computerized system denies an entry of the file to the enterprise system.