RNN Malware Detection in Sandboxes via Behavior Sequence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods, such as virus scanning and sandboxing, are resource-intensive and inefficient in identifying malicious files during runtime, as they require full execution and consume significant resources.
Innovation Solution
Implementing a system that uses recursive neural networks (RNNs) to analyze behavior sequences in a virtual runtime environment without full execution, allowing for on-the-fly identification of malware by tracking behavior over time and terminating execution once malicious behavior is detected, thus conserving resources and improving scanning efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandboxing a file for full execution is performed to detect malware, then detection accuracy is improved, but resource consumption increases
Solution Approach 1:
The system performs partial execution of the file in a sandbox environment, monitoring behavior sequences to detect malware indicators before completing full execution. This allows detection of malicious patterns without consuming resources required for complete file runtime, achieving reliable detection with reduced resource usage.
Solution Approach 2:
The system executes preliminary behavior analysis in a sandbox before allowing full file execution. By pre-screening files for malicious behavior sequences and establishing risk profiles beforehand, the system can block potentially harmful files without requiring their complete execution, thus improving detection reliability while conserving computational resources.
2Measurement precision
If full file execution is performed in sandbox to identify malware behavior, then detection precision is improved, but execution time increases
Solution Approach 1:
The system skips the requirement for complete file execution by monitoring behavior sequences during partial runtime. When malicious patterns are detected in the behavior sequence, the system can terminate analysis early, achieving precise malware identification without the time cost of full execution.
Solution Approach 2:
The system performs partial execution with continuous behavior monitoring, extracting sufficient precision data from incomplete runtime to identify malware. This approach achieves high detection precision by capturing critical malicious behaviors early in the execution process without requiring the file to complete its entire execution cycle.
3Reliability
If virtual runtime environments are allocated for each file analysis, then detection reliability is improved, but device complexity increases
Solution Approach 1:
The system creates a single shared sandbox environment that can be reused across multiple file analyses. This virtual runtime environment serves multiple functions: isolating different files, monitoring behavior sequences, and providing a controlled execution context. By making the sandbox universal rather than creating dedicated environments for each file, the system maintains isolation security while reducing the complexity of managing numerous separate virtual environments.
Data Source
AI summary
A file copy is executed in a virtual runtime environment that tracks behavior using RNN taking runtime behavior of at least a first time into account with current runtime behavior at a second time. This is responsive to not finding a known signature for suspicious activity during virus scanning. A behavior sequence is identified on-the-fly during file copy execution that is indicative of malware, prior to completing the execution, the behavior sequence involving at least two actions taken at different times during file copy execution. Responsive to the identification, the execution is terminated and the virtual runtime environment is returned to the pool of available virtual runtime environments.