Malware Detection via Virtual Machine Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated malware evades detection, posing a challenge for existing techniques to effectively identify and prevent malware harm in computer systems.
Innovation Solution
A data appliance and virtual machine servers collaborate for real-time malware analysis, using traffic analysis and heuristic-based techniques to determine malicious behavior, with the data appliance enforcing policies and generating signatures to block malicious files and prevent future transfers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection techniques are used, then detection capability is maintained, but sophisticated malware can evade detection
Solution Approach 1:
The patent introduces virtual machine servers as intermediary environments to execute malware and capture network traffic, and introduces traffic analysis as a mediator to detect malware behavior patterns. This intermediary approach allows detection of sophisticated malware that evades traditional signature-based methods by observing actual runtime behavior in a controlled environment.
Solution Approach 2:
The system implements feedback loops where network traffic from virtual machine execution is continuously analyzed, and detection results feed back into updating security policies and blocking mechanisms. This feedback enables the system to adapt to new malware variants and improve detection accuracy over time, addressing the reliability issue with sophisticated malware.
2Measurement precision
If real-time malware analysis is implemented, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the malware detection system into distinct functional components: virtual machine servers for execution, traffic analysis for behavior detection, data appliance for policy enforcement, and signature generation for future blocking. This segmentation allows each component to specialize in specific tasks, improving overall detection capability while managing complexity through modular architecture.
Solution Approach 2:
The virtual machine servers serve multiple functions: executing malware samples, capturing network traffic, and providing a controlled execution environment. The data appliance performs multiple roles including policy enforcement, traffic analysis coordination, and signature generation. This multi-functionality reduces the need for separate specialized systems, managing complexity while maintaining high detection accuracy.
3Measurement precision
If traffic analysis is used to detect malware, then detection capability improves, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by pre-configuring virtual machine environments with necessary tools and policies before malware execution. Network traffic analysis rules and detection policies are pre-established, allowing rapid analysis during actual malware execution. This preliminary preparation reduces processing time during real-time detection while maintaining high accuracy.
Solution Approach 2:
The traffic analysis operates periodically during malware execution in the virtual machine, analyzing network traffic at strategic intervals rather than continuously processing every packet. This periodic approach captures sufficient behavioral patterns for accurate detection while reducing computational overhead and processing time compared to continuous analysis.
Data Source
AI summary
Detecting malware is disclosed. A candidate malware application is caused to be executed using a virtual machine. Traffic analysis is performed on network traffic associated with the execution of the candidate malware application. A determination is made as to whether the candidate malware application is malicious or not, based at least in part on the traffic analysis and an application type associated with the candidate malware application.