Malware Detection via Virtualized Environment Anti-Evasion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are ineffective against increasingly sophisticated malware that evades detection by using anti-virtual machine techniques, leading to a need for improved techniques to prevent malware propagation in computer systems.
Innovation Solution
A data appliance configured to work with virtual machine servers for real-time malware analysis, using behavior profiling and signature generation to identify and block malicious attachments, while also detecting and thwarting anti-virtual machine actions by randomizing virtual machine identifiers and applying hotpatches to deceive malware into believing it is not in a virtual environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security scan is required prior to download of attachment, then malware detection capability is improved, but legitimate attachments are blocked and user productivity deteriorates
Solution Approach 1:
The system performs preliminary security scanning of attachments before they are downloaded to the user's computer. The security scan is executed in advance on the attachment file, and only after the scan completes and confirms safety does the system allow the download to proceed. This preliminary action prevents malware from reaching the user while maintaining productivity by avoiding blocks on legitimate files.
2Object-affected harmful factors
If all attachments are blocked by computer system, then malware propagation is prevented, but legitimate attachments become unavailable to users
Solution Approach 1:
Instead of applying a uniform block to all attachments, the system applies differentiated handling based on the specific attachment's characteristics. Each attachment is individually scanned and evaluated, allowing legitimate attachments to pass through while blocking only those identified as malicious. This local quality approach maintains ease of operation for legitimate files while preventing malware propagation.
3Adaptability or versatility
If malware authors use anti-virtual machine techniques, then malware evasion capability is improved, but detection accuracy of security systems deteriorates
Solution Approach 1:
The system introduces a virtual machine environment as an intermediary layer between the malware and the detection system. By executing suspected malware within a controlled virtual machine, the security system can observe the malware's behavior in an isolated environment, enabling accurate detection of evasion techniques while maintaining the ability to analyze sophisticated malware samples.
Data Source
AI summary
A candidate malware that potentially includes at least one malicious element is received. The candidate malware is executed using a virtualized environment. A determination is made that the candidate malware, while executing using the virtualized environment, has taken at least one anti-virtual machine action, wherein the anti-virtual machine action is indicative of an attempt by the candidate malware to evade detection of the malicious element by the system when the candidate malware is executed using a virtualized environment. In response to the determination, an alert that the candidate malware is malicious is generated as output.