Malware Detection via Sandbox Behavioral Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods struggle to identify repackaged malware due to obfuscation techniques, leading to missed detections and increased logistical challenges in tracking and analyzing vast amounts of malware data, which complicates the prevention and mitigation of malware spread across computer systems and networks.
Innovation Solution
A method and system that classify instructions in computer data as malware based on malicious actions, generate detection requirements, and send associated data to assets for detection, utilizing a non-transitory computer readable storage medium and analysis computers to identify and characterize new malware, enabling effective detection and prevention of malware spread.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional pattern matching methods are used for malware detection, then processing speed is maintained, but detection accuracy deteriorates due to obfuscation and repackaging techniques
Solution Approach 1:
The patent introduces a sandbox environment as an intermediary between the malware sample and the detection system. The sandbox executes the malware in a controlled, isolated virtual environment, capturing behavioral data and system interactions. This mediator allows the system to detect repackaged and obfuscated malware by observing actual malicious behavior rather than relying on static pattern matching, thereby improving detection accuracy without significantly increasing processing complexity.
Solution Approach 2:
The patent replaces conventional mechanical pattern matching mechanisms with a virtualized execution environment. Instead of scanning for static signatures, the system substitutes a virtual sandbox that dynamically executes malware samples and captures behavioral characteristics. This substitution enables detection of obfuscated and repackaged malware by observing runtime behavior, effectively overcoming the limitations of traditional signature-based approaches.
2Reliability
If deep packet inspection is used to scan malware code, then detection capability is improved, but processing time increases and performance deteriorates
Solution Approach 1:
The patent segments the malware analysis process into multiple phases: initial static analysis, sandbox execution, and behavioral characterization. By dividing the inspection process into discrete stages, the system can perform lightweight initial checks quickly, then only execute full sandbox analysis when necessary. This segmentation maintains high processing throughput for obvious cases while providing deep inspection capability for suspicious samples, resolving the contradiction between detection capability and processing speed.
Solution Approach 2:
The patent applies partial action by performing only the necessary level of inspection based on risk assessment. For samples with obvious malicious indicators, the system performs minimal analysis and blocks them immediately. For ambiguous samples, it executes more comprehensive sandbox analysis. This selective depth of inspection maintains overall processing speed while ensuring thorough analysis only when needed, balancing reliability and productivity.
3Measurement precision
If new malware samples are analyzed in detail, then detection accuracy is improved, but the volume of data to process increases
Solution Approach 1:
The patent extracts only the essential behavioral characteristics and signatures from detailed malware analysis. The sandbox captures key behavioral data points (system calls, file operations, network connections) and extracts only the relevant features needed for detection rule generation. By taking out only the necessary information rather than processing every detail, the system maintains high characterization accuracy while minimizing the volume of data that needs to be stored and processed in the future.
Solution Approach 2:
The patent discards redundant and overly detailed information from malware analysis, retaining only the essential behavioral patterns and signatures. The sandbox analysis filters out noise and unnecessary data, recovering only the critical characteristics needed for detection. This selective retention reduces the volume of data that must be stored and processed while maintaining sufficient accuracy for effective malware detection and response.
Data Source
AI summary
Methods and apparatus consistent with the present disclosure may be used after a computer network has been successfully attacked by new malicious program code. Such methods may include collecting data from computers that have been affected by the new malicious program code and this data may be used to identify a type of damage performed by the new malicious code. The collected data may also include a copy of the new malicious program code. Methods consistent with the present disclosure may also include allowing the new malicious program code to execute at an isolated computer while actions and instructions that cause the damage are identified. Signatures may be generated from the identified instructions after which the signatures or data that describes the damaging actions are provided to computing resources such that those resources can detect the new malware program code.