Malicious URI Detection via Sandbox Sinkholing and ML Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious Uniform Resource Identifier (URI) data items, such as those used in cybercrime, face challenges in accuracy and processing load, particularly in cloud computing and virtualized environments, where new obfuscation and evasion techniques are prevalent, and fail to identify the full lifecycle of cyber-attacks known as the Kill Chain.
Innovation Solution
A computer-implemented method that automatically gathers and analyzes URI data items by testing candidate malicious binary files in a sandbox environment, monitoring network activity to identify connections with malicious servers, and using sinkholing techniques to intercept communications, while employing machine learning algorithms to classify and normalize data, thereby reducing unnecessary resource allocation and providing warnings on potential cyber threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If supervised machine learning techniques are used to detect malware in computer networks, then detection capability is improved, but false positives increase and processing load increases
Solution Approach 1:
The patent segments the malware detection process into multiple specialized components: a sandboxing environment for safe execution, a network activity monitoring module for capturing connections, and a classification module for analyzing captured data. This segmentation allows each component to focus on specific aspects, improving overall detection accuracy while reducing false positives through specialized analysis rather than blanket machine learning application.
Solution Approach 2:
The patent introduces an intermediary sandboxing environment between the malware sample and the detection system. This sandbox acts as a mediator that safely executes malicious code and captures its network activity without risking the host system. The intermediary approach enables accurate detection of malicious behavior while isolating the analysis process, thereby improving reliability without proportionally increasing processing load on the main system.
2Measurement precision
If comprehensive analysis of all URI data items is performed, then detection accuracy is improved, but processing load increases
Solution Approach 1:
The patent applies preliminary action by first executing binary files in a sandboxing environment before analyzing their network activity. This preliminary execution phase allows the system to capture only the actual network connections made by malicious code, filtering out irrelevant URIs beforehand. By performing this preliminary analysis, the system reduces the volume of URI data requiring subsequent classification, thereby improving processing efficiency while maintaining detection accuracy.
3Object-affected harmful factors
If sandboxing environment is used to test binary files, then safety is improved, but processing time increases
Solution Approach 1:
The patent uses copying by creating a sandboxed virtual environment that replicates the necessary system components for safe malware execution. Instead of risking the actual system, the sandbox copies essential services and network interfaces in an isolated setting. This copying approach maintains system safety while enabling parallel execution of multiple binary files, thereby reducing overall analysis time through concurrent processing.
Data Source
AI summary
A computer-implemented method, a system and a computer program for identifying malicious URI data items are provided. The method a) gathers URI data items and b) analyses said URI data items to classify them into malicious URI data items and non-malicious URI data items. The method also c1) intercepts communications with malicious servers, identified by malicious URIs, from several computing entities, using sinkholing techniques, and uncovers and retrieves information which is being exfiltrated to said malicious or supervised servers, and c2) periodically monitors a status of the malicious servers identified by the malicious URIs, to control if they have been taken down or not, and simulates an infected bot to get updates of the commands sent from said malicious servers. The method also d) processes the uncovered information with learning algorithms, e) delivers to a mass storage device normalized and interpreted data; and f) provides warnings about potential cyber threats.