Malware Detection Sandbox Delay Parameter Adjustment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods using sandbox technology face low accuracy due to malware's ability to evade detection through delay operations, which are not effectively monitored within the limited hardware and software resources.
Innovation Solution
The method involves running to-be-detected software in a sandbox, recording operations, detecting delay attributes, adjusting delay parameters if necessary, and comparing recorded operations with malicious behavior databases to determine if the software is malware, thereby exposing malicious behaviors within a preset duration for improved detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandbox technology is used to monitor software operations, then malware detection capability is improved, but detection accuracy deteriorates due to delay operations
Solution Approach 1:
The patent applies preliminary action by detecting and adjusting delay parameters before the malware can execute its malicious behavior. The system monitors for delay operations (such as sleep statements) during the initial monitoring period and proactively adjusts the delay duration to ensure malicious behaviors are exposed within the monitoring timeframe, rather than waiting for the delay to complete naturally.
Solution Approach 2:
The patent implements parameter changes by dynamically modifying the delay duration parameter of detected delay operations. When a delay operation is identified, the system changes its duration parameter from the original value to a shorter value that ensures the malicious behavior will be exposed within the preset monitoring duration, thereby maintaining detection accuracy.
2Measurement precision
If monitoring duration is extended to capture delayed malicious behaviors, then detection accuracy is improved, but hardware resource consumption increases
Solution Approach 1:
The patent applies dynamics by making the monitoring process adaptive rather than static. Instead of using a fixed, extended monitoring duration that would consume excessive resources, the system dynamically adjusts the effective monitoring window by modifying delay operation parameters. This allows the system to capture malicious behaviors that would otherwise be delayed beyond the monitoring period, while maintaining resource efficiency through targeted parameter adjustment rather than blanket extension of monitoring time.
Solution Approach 2:
The patent uses parameter changes to optimize the balance between detection accuracy and resource consumption. By modifying the delay duration parameter of suspicious operations, the system ensures malicious behaviors are exposed within the preset monitoring duration, eliminating the need to extend monitoring time and thereby avoiding excessive hardware resource usage while maintaining high detection accuracy.
3Adaptability or versatility
If delay operations are allowed to execute normally, then malware can evade detection, but detection accuracy decreases
Solution Approach 1:
The patent implements preliminary anti-action by detecting delay operations and adjusting their parameters before the malware can successfully evade detection. The system proactively identifies suspicious delay statements and modifies their execution timing, preventing the malware from using delay operations as an effective evasion mechanism. This counter-measure is applied in advance, neutralizing the malware's evasion capability before it can take effect.
Solution Approach 2:
The patent applies parameter changes to neutralize malware evasion techniques. By modifying the delay duration parameter of detected delay operations, the system ensures that malicious behaviors are not postponed beyond the monitoring window, thereby preventing malware from successfully evading detection through timing-based evasion strategies.
Data Source
AI summary
A malware detection method and a malware detection apparatus, where the method includes running to-be-detected software in a sandbox, and recording at least one operation, and in a process of recording the at least one operation, when it is detected that any interface that has a delay attribute in the sandbox is called, determining whether delay duration corresponding to a first delay length parameter of the called interface is greater than a preset duration. When the delay duration corresponding to the first delay length parameter is greater than the preset duration, delay duration of delay execution is reduced to enable the malicious behavior to be executed in the process of recording the at least one operation executed within the preset duration after the to-be-detected software starts to run.