Malicious File Detection Using Virtual Machine Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for detecting malicious files in network traffic are inefficient in terms of computing resource utilization, making them unsuitable for effective automated protection against targeted attacks, particularly those using files with malicious content in widely used formats.
Innovation Solution
A server system that receives network traffic, filters and analyzes files using virtual machines to classify suspicious files as malicious based on behavioral changes, employing a set of analysis rules and considering format, behavioral reports, electronic signatures, and trusted sources to minimize computational load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current systems analyze all files in network traffic using comprehensive behavioral analysis, then detection accuracy improves, but computational resource consumption increases significantly
Solution Approach 1:
The system segments file analysis into two distinct paths: a fast path using signature-based detection for known threats, and a slow path using behavioral analysis in virtual machines for suspicious files. This segmentation allows the system to achieve high detection accuracy for malicious files while minimizing computational resource consumption by reserving resource-intensive analysis only for files that warrant deeper inspection.
Solution Approach 2:
The system applies different analysis methods to different files based on their risk profile. Low-risk files receive minimal signature-based checking, while high-risk files identified through heuristics or format analysis receive comprehensive behavioral analysis. This local quality approach optimizes resource allocation by concentrating computational power where it is most needed.
2Speed
If the system uses signature-based detection methods, then detection speed improves, but effectiveness against zero-day and modified threats deteriorates
Solution Approach 1:
The system dynamically adapts its detection approach based on file characteristics and risk assessment. Files are initially evaluated using fast signature-based methods, and those triggering heuristics or format-based suspicion automatically transition to dynamic behavioral analysis in virtual machines. This dynamic approach maintains high detection speed for known threats while ensuring thorough analysis of potentially novel threats.
Solution Approach 2:
The system introduces an intermediary layer of heuristics and format-based analysis between signature detection and full behavioral analysis. This intermediary layer identifies suspicious files that warrant deeper inspection, effectively bridging the gap between fast but less accurate signature matching and slow but comprehensive behavioral analysis.
3Reliability
If the system performs comprehensive behavioral analysis on all suspicious files, then detection reliability improves, but processing time increases
Solution Approach 1:
The system performs partial behavioral analysis by monitoring only specific status parameters and behaviors in virtual machines rather than complete system analysis. This partial action approach maintains high detection reliability by focusing on critical indicators of malicious behavior while significantly reducing processing time through selective monitoring of key system events and file operations.
4Reliability
If the system blocks all potentially malicious files, then protection effectiveness improves, but false positive rate increases
Solution Approach 1:
The system implements feedback loops where behavioral analysis results inform future detection decisions. Files that exhibit malicious behavior patterns are added to blocklists, while false positives are analyzed to refine detection rules. This feedback mechanism improves protection effectiveness over time while reducing false positives through continuous learning and adaptation.
Data Source
AI summary
There is disclosed a method for determining malicious files in a network traffic, the method executable by a server. The method comprises: receiving the network traffic from a data communication network, retrieving a plurality of files from the network traffic, analyzing the plurality of files in order to detect at least one suspicious file, running the at least one suspicious file in at least one virtual machine, the at least one virtual machine associated with a set of the status parameters, determining changes in the set of the status parameters of the at least of one virtual machine, analyzing the changes in the set of status parameters using a set of the analysis rules such that to classify the at least one suspicious file as a malicious file based on the changes in the set of status parameters being indicative of the at least one file being the malicious file.