Malicious File Detection via Virtual Machine Event Discrepancy Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems face challenges in identifying malicious files that resist analysis by employing obfuscation and emulation resistance mechanisms, which can go undetected if they do not immediately manifest malicious activity, especially in multi-core processor environments where workload is spread across cores.
Innovation Solution
The method involves intercepting and analyzing files in an isolated virtual machine environment, generating a log of security-related events, forming a behavior template, and calculating a danger coefficient based on discrepancies between events in the virtual machine and the actual execution environment to recognize malicious files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malicious software uses obfuscation and emulation resistance mechanisms, then the malicious code becomes harder to analyze and detect, but the security analysis system loses the ability to accurately identify malicious files
Solution Approach 1:
The system performs preliminary analysis of security-related events during virtual machine execution before making a final maliciousness determination. By capturing and analyzing API function calls, system calls, and other security events during the sandbox execution phase, the system prepares detection data in advance that can reveal obfuscation and emulation resistance mechanisms even when malicious activity is not immediately manifested.
Solution Approach 2:
The system implements feedback mechanisms by comparing expected security event patterns against actual events captured during virtual machine execution. When discrepancies are detected in the sequence or nature of security events, the system adjusts its analysis to flag potential malicious behavior, creating a closed-loop detection system that continuously refines its identification accuracy.
2Object-affected harmful factors
If malicious software delays manifestation of malicious activity, then the malicious software can evade immediate detection, but the detection system must monitor for extended periods to identify threats
Solution Approach 1:
The system captures security-related events during the entire virtual machine execution lifecycle, including preparatory phases before malicious activity manifests. By logging API function calls, file access attempts, and system calls during the execution window (even when no obvious malicious behavior is present), the system prepares detection evidence in advance that can be analyzed later to identify delayed malicious activity patterns.
Solution Approach 2:
The system creates a copy of the security event log during virtual machine execution that preserves the complete sequence of events. This copied event sequence can be analyzed separately to identify patterns indicative of delayed malicious activity, allowing the system to detect threats that manifest after the original execution context has been terminated.
3Measurement precision
If security systems perform comprehensive analysis of all file execution events, then detection accuracy improves, but system complexity and computational resources increase
Solution Approach 1:
The system applies local quality by focusing analysis on specific security-related events rather than all execution events. Instead of monitoring every API call and system call with equal depth, the system identifies and prioritizes security-critical events (such as attempts to access sensitive files, unusual API sequences, or emulation resistance indicators) for detailed analysis, while applying lighter monitoring to routine operations.
Solution Approach 2:
The system extracts only the security-related subset of events from the complete execution log for detailed analysis. By separating security-critical events from routine execution events and analyzing only the extracted security subset, the system maintains high detection accuracy while reducing the computational complexity and resource requirements compared to comprehensive analysis of all events.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems and methods for recognizing files as malicious. One exemplary method comprises intercepting a file for analysis received at a computing device of a user, opening the file for analysis in an environment for safe execution, generating a log that stores a portion of information occurring during opening of the file for analysis in the environment for safe execution, analyzing the log to recognize a first set of security related events from the portion of information, tracking a second set of security related events when the file for analysis is opened on the computing device, comparing the second set of security related events and the first set of security related events to identify a discrepancy; and in response to identifying the discrepancy, recognizing the file under analysis as malicious.