Malicious File Detection via Virtual Environment Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malicious file detection technologies face challenges in accurately identifying malicious files, particularly when a parent sample file and a subsample file are involved, as they often operate in incompatible virtual environments, leading to incomplete detection due to the inability to monitor the behavior sequence of the subsample file.
Innovation Solution
A method where a detection device runs a sample file in a first virtual operating environment, intercepts HTTP requests to identify and associate subsample files, and performs comprehensive detection by running both files in appropriate virtual environments to establish an association relationship and determine maliciousness based on behavior sequences and detection results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single virtual operating environment is used to run both parent sample file and subsample file, then device complexity is reduced, but detection precision deteriorates because the files may require incompatible operating environments
Solution Approach 1:
The patent segments the virtual operating environment into multiple independent environments (first virtual operating environment for parent sample file, second virtual operating environment for subsample file). Each environment can be independently configured with appropriate operating systems, architectures, and dependencies, allowing accurate detection of files with different environmental requirements while maintaining detectability through separate execution contexts.
2Measurement precision
If multiple virtual operating environments are configured for different sample files, then detection precision is improved, but device complexity increases due to environment management
Solution Approach 1:
The patent introduces a first data flow identifier and second data flow identifier as intermediaries to establish correspondence between the first virtual operating environment and second virtual operating environment. These identifiers act as mediators that link the parent sample file execution context with the subsample file execution context, enabling coordinated detection across multiple environments without requiring complex direct management of environment interactions.
3Measurement precision
If data flow identifiers are used to associate parent and subsample files, then detection precision is improved by enabling cross-environment correlation, but device complexity increases due to identifier management
Solution Approach 1:
The patent creates a correspondence relationship by copying or mapping the first data flow identifier to the second data flow identifier. This copying mechanism establishes a link between the parent sample file and subsample file without requiring complex management of the actual files themselves. The identifier correspondence serves as a lightweight reference system that enables association while minimizing overhead.
Data Source
AI summary
A detection device runs a first sample file in a first virtual operating environment, when the first sample file sends a first Hypertext Transfer Protocol (HTTP) request to a server, the detection device obtains an identifier of the first sample file and a first data flow identifier correspondingly from the first HTTP request. The detection device obtains a second data flow identifier and a second sample file carried in subsequently transmitted data flow. If the second data flow identifier is the same as the first data flow identifier in the correspondence, the detection device determines that the second sample file is a subsample file of the first sample file, detects the second sample file to obtain a detection result of the second sample file, and determines, based on the detection result of the second sample file, that the first sample file is a malicious file.