Malicious Code Detection via Virtual Environment Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malicious code detection methods struggle to identify unknown malicious code and may cause system malfunctions when detecting code behavior, as they rely on binary pattern comparisons or kernel hooking, which are ineffective for disguised malicious threads.
Innovation Solution
A system and method that extracts information on threads from processes running on a computer system, preliminarily determines malicious code by analyzing virtual memory, PE features, and thread relationships, and then analyzes the code's behavior in a virtual environment to forcibly terminate it if malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If binary pattern comparison is used to detect malicious code, then known malicious code can be detected, but unknown malicious code cannot be detected
Solution Approach 1:
The system performs preliminary analysis of thread information, virtual memory, PE features, and thread stacks before final detection. This preliminary action identifies suspicious threads and extracts code for further analysis in a virtual environment, enabling detection of both known and unknown malicious code through multi-stage verification
Solution Approach 2:
A virtual environment is introduced as an intermediary between the code extraction stage and the final detection decision. The virtual environment executes extracted code safely and generates behavior logs, which then inform the final malicious code determination. This intermediary enables analysis of code behavior without direct system risk
2Measurement precision
If kernel layer hooking is used to detect malicious code, then detection coverage is increased, but system malfunction and critical failure may occur
Solution Approach 1:
The system extracts thread information, virtual memory data, PE features, and thread stack information from running processes without modifying or hooking kernel layer APIs. This extraction approach provides comprehensive detection coverage while maintaining system stability by avoiding kernel-level interference
Solution Approach 2:
Instead of hooking kernel APIs directly, the system creates a virtual environment that copies and isolates code execution. The virtual environment executes extracted code in a sandboxed context, allowing behavior analysis without affecting the host system's kernel operations
3Ease of operation
If specific API hooking is used to detect malicious code, then detection is simplified, but user must manually monitor code behavior which increases operational complexity
Solution Approach 1:
The system automatically extracts thread information, analyzes virtual memory and PE features, and executes code in a virtual environment without requiring manual user intervention. The automated multi-stage analysis process eliminates the need for users to manually monitor code behavior while maintaining comprehensive detection capability
Data Source
AI summary
Provided are an apparatus, system and method for detecting malicious code inserted into a normal process in disguise. The apparatus includes a malicious code detection module for extracting information on a thread generated by a process running on a computer system to identify code related to the thread, preliminarily determining whether or not the identified code is malicious and extracting the code preliminarily determined to be malicious; and a forcible malicious code termination module for finally determining the code as malicious code based on an analysis result of behavior of the extracted code executed in a virtual environment and forcibly terminating execution of the code.