Malware Detection Evasion via Execution Report
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware can evade detection by recognizing it is running in a sandbox environment and disguising its behavior as benign, leading to incorrect classification and potential execution on endpoints, which can result in malicious activities.
Innovation Solution
Implementing an execution report system that restricts malware operations to those validated as benign in a sandbox environment, using an anti-malware engine to assess system calls and limit operations to those reported in the execution report, thereby preventing malicious actions on the target machine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandbox environment is used to validate applications, then application safety can be improved, but malware can detect the sandbox environment and disguise its behavior, leading to false positive results
Solution Approach 1:
The patent performs preliminary actions by capturing all system calls and indicators of compromise (IOCs) during sandbox execution before the application is deployed to the endpoint. The sandbox records benign operations in advance, creating a baseline of allowed behaviors that prevents malware from executing malicious actions on the actual endpoint, even if the malware detects the sandbox environment and disguises its behavior.
Solution Approach 2:
The patent implements feedback mechanisms where the sandbox continuously monitors application behavior, captures system calls, and provides feedback about benign operations to the endpoint system. This feedback loop ensures that only behaviors validated as benign in the controlled sandbox environment are permitted on the endpoint, maintaining detection accuracy while allowing safe execution.
2Object-affected harmful factors
If sandbox validation is performed for all downloaded applications, then malicious behavior can be prevented, but system complexity and processing time increase
Solution Approach 1:
The patent extracts only the essential validation function from the complex sandboxing process by capturing and recording only the benign system calls and IOCs during sandbox execution. This extracted validation data is then used at the endpoint to allow or block specific operations, simplifying the overall system architecture while maintaining effective malware prevention without requiring continuous complex sandboxing.
Solution Approach 2:
The patent creates a simplified copy of the sandbox validation results in the form of recorded benign operations and IOCs. Instead of continuously running complex sandbox environments, the system uses these copied validation data to make decisions at the endpoint, reducing system complexity while maintaining the protective function.
3Ease of operation
If sandbox returns benign verdict for malware, then application execution is allowed, but malware can execute malicious operations on the endpoint
Solution Approach 1:
The patent performs preliminary capture of all benign operations during sandbox execution before allowing execution on the endpoint. This preliminary recording creates a comprehensive allowlist of behaviors that the malware can safely perform, preventing it from executing any malicious operations on the endpoint even though it was allowed to execute based on sandbox validation.
Solution Approach 2:
The patent introduces an intermediary layer in the form of recorded benign operations and IOCs that mediates between the sandbox validation and endpoint execution. This intermediary data structure allows the system to permit execution based on sandbox results while simultaneously controlling and monitoring specific operations to prevent malicious behavior on the endpoint.
Data Source
AI summary
An application downloaded from the network onto a target (production) machine can be validated in a sandbox environment. An execution report can be generated during the validation. When the validated application is executed on the target machine, operations performed by the application are limited based on the execution report.