Malware Analysis Group Testing Virtual Machine Sandboxes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are inefficient and computationally expensive, particularly when dealing with large volumes of computer instruction sequences, as they require launching numerous virtual machine sandboxes to analyze each sequence for malicious behavior.
Innovation Solution
Implementing group testing and static analysis to efficiently assign and analyze computer instruction sequences, where sequences are grouped and executed in virtual machine sandboxes, with static analysis adjusting execution time and group sizes based on the likelihood of malicious behavior, reducing the number of sandboxes needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavioral analysis is performed by executing each software instruction sequence in a virtual machine sandbox, then malware detection accuracy is improved, but computational overhead and time consumption increase significantly
Solution Approach 1:
The patent segments the analysis process into two distinct phases: static analysis (performed on all instruction sequences to identify suspicious characteristics) and behavioral analysis (performed only on sequences flagged as suspicious). This segmentation allows the system to maintain high detection accuracy through behavioral analysis while improving throughput by limiting sandbox execution to only those sequences that pass the initial static analysis filter.
Solution Approach 2:
The patent applies preliminary static analysis to all instruction sequences before subjecting them to behavioral analysis in the sandbox. This preliminary action identifies and filters out benign sequences, ensuring that only suspicious sequences undergo the computationally expensive behavioral analysis, thereby reducing overall computational overhead while maintaining detection accuracy.
2Speed
If the number of virtual machine sandboxes is increased to analyze more instruction sequences in parallel, then analysis speed is improved, but resource consumption increases
Solution Approach 1:
The patent applies partial action by performing static analysis on all instruction sequences and behavioral analysis only on a subset identified as suspicious. This approach achieves sufficient analysis speed by processing sequences in two passes, while avoiding the excessive resource consumption that would result from launching sandboxes for every single sequence.
3Productivity
If static analysis is used to pre-filter instruction sequences, then computational overhead is reduced, but detection precision may be compromised
Solution Approach 1:
The patent segments detection into static analysis (for efficiency) and behavioral analysis (for precision). The static analysis phase filters sequences based on code characteristics, while the behavioral analysis phase in the sandbox provides the precision needed for accurate malware identification, ensuring that neither efficiency nor precision is compromised.
Solution Approach 2:
The patent uses static analysis as an intermediary filtering mechanism between the large set of instruction sequences and the sandbox behavioral analysis. This intermediary layer reduces the number of sequences requiring expensive behavioral analysis while ensuring that potentially malicious sequences are not missed, as they will be caught by either the static analysis filter or the subsequent behavioral analysis.
Data Source
AI summary
Malicious activity is identified in a plurality of sequences of computer instructions by identifying a plurality of sequences of computer instructions of interest, and assigning the plurality of sequences of computer instructions into two or more groups. A virtual machine sandbox is executed for each of the two or more groups, and each of the plurality of sequences of computer instructions is executed in the virtual machine sandbox into which the sequence of computer instructions has been assigned. Behavior of the executing instruction sequences is monitored, and is used to determine whether each of the groups has at least one executed sequence of computer instructions that is likely malicious.