Sandbox Simulator Intercepts Function Calls to Trap Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sandbox-evading malware is challenging to identify in executables and processes, as it detects sandbox environments and refrains from malicious behavior, only to execute malicious code in production environments, requiring significant time and resources for detection.
Innovation Solution
A computerized method that detects process execution events for unknown executables, activates a sandbox simulator to intercept function calls, and generates sandbox responses, effectively tricking malware into behaving as if it is in a sandbox environment, thereby preventing malicious behavior in production environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware analysis methods are used, then malware can be detected in sandbox environments, but sandbox-evading malware detects the sandbox and refrains from malicious behavior, leading to false negatives
Solution Approach 1:
A sandbox simulator component is introduced as an intermediary that intercepts function calls from the executing process and generates synthetic sandbox responses. This mediator tricks sandbox-evading malware into believing it is running in a sandbox environment, causing it to exhibit its true malicious behavior patterns while actually running in a production environment.
Solution Approach 2:
Instead of creating a real sandbox environment to detect malware, the system inverts the approach by injecting sandbox-like behavior responses into a production environment. This allows malware to be tricked into revealing its true nature without requiring actual sandbox isolation.
2Reliability
If malware analysis is performed before execution, then malicious code can be identified, but it requires significant time and processing resources
Solution Approach 1:
The sandbox simulator is activated in advance and prepares to intercept function calls before the unknown executable runs. By having the detection mechanism ready and waiting, the system can immediately analyze malware behavior as it occurs during normal execution without requiring preliminary analysis to complete first.
Solution Approach 2:
The system enables continuous monitoring of the executing process through the function call hook interface, allowing malware analysis to occur continuously during normal execution rather than requiring a separate analysis phase. This eliminates gaps between execution and detection.
3Productivity
If unknown executables are executed immediately in production environments, then productivity is improved, but sandbox-evading malware can perform malicious operations
Solution Approach 1:
The sandbox simulator performs preliminary anti-action by intercepting function calls and providing sandbox-like responses before malware can execute its malicious payload. This preemptive measure tricks the malware into remaining dormant or exhibiting benign behavior patterns, preventing harmful actions before they occur.
Solution Approach 2:
The function call hook interface acts as an intermediary layer between the malware and the production environment, capturing function calls and replacing them with sandbox responses. This mediator prevents direct interaction between malware and production systems, blocking malicious operations while allowing execution to proceed.
Data Source
AI summary
The disclosure herein describes executing unknown processes while preventing sandbox-evading malware therein from performing malicious behavior. A process execution event associated with an executable is detected, wherein the executable is to be executed in a production environment. The executable is determined to be an unknown executable (e.g., an executable that has not been analyzed for malware) using signature data in the process execution event. A function call hook interface of a sandbox simulator is activated, and a process of the executable is executed in the production environment. Any function calls from the executing process are intercepted by the activated function call hook interface, and sandbox-style responses to the intercepted function call are generated using sandbox response data of the sandbox simulator. The generated sandbox responses are provided to the executing process, whereby malware included in the executable behaves as if the executing process is executing in a sandbox environment.