Single Virtual Machine for Multi-Version Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems require multiple virtual machines to detect malware in different versions of software applications, which is resource-intensive and often results in decreased detection rates due to resource limitations, causing certain versions to be ignored.
Innovation Solution
Executing multiple versions of a software application within a single virtual machine, allowing for concurrent or serial execution of each version to detect malicious behavior without the need for multiple virtual machines, thereby reducing resource requirements and improving detection rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple virtual machines are used to execute different versions of software applications, then malware detection coverage across versions is improved, but resource consumption (CPU, memory, disk) increases
Solution Approach 1:
The patent merges multiple virtual machine environments into a single virtual machine by installing multiple versions of the same software application (e.g., multiple Java versions, multiple Adobe Reader versions) within one VM. This allows the system to test malware against different software versions without provisioning separate VMs for each version, thereby maintaining comprehensive detection coverage while reducing resource consumption.
Solution Approach 2:
A single virtual machine is designed to perform multiple functions by hosting multiple versions of software applications simultaneously. The VM becomes a universal testing environment that can evaluate malware behavior across different software versions, eliminating the need for dedicated VMs for each version and optimizing resource utilization.
2Reliability
If multiple virtual machines are deployed to test all software versions, then detection rate is improved, but management time (installation, configuration) increases
Solution Approach 1:
The patent consolidates the management of multiple software versions into a single virtual machine environment. Instead of installing and configuring multiple versions across multiple VMs, the system installs all required versions within one VM, significantly reducing the time and effort required for system setup, maintenance, and updates.
Solution Approach 2:
The system performs preliminary installation of multiple software versions within the virtual machine before malware testing begins. This pre-configuration approach ensures that all necessary software environments are ready in advance, eliminating the need for repeated installation and configuration tasks when testing new malware samples.
3Use of energy by moving object
If resource limitations are imposed to manage multiple virtual machines, then resource usage is controlled, but certain software versions are ignored resulting in decreased detection rate
Solution Approach 1:
The patent resolves this contradiction by merging all software version testing into a single virtual machine, which allows the system to maintain control over resource usage while ensuring that all software versions are tested. The VM can allocate resources dynamically across different software versions, preventing any version from being excluded due to resource constraints.
Data Source
AI summary
A single virtual machine is implemented upon a computer and an operating system executes within this virtual machine. A sample file suspected of being malware is received and any number of versions of the software application corresponding to the sample file are installed. Each version of the software application is executed within the operating system, each version opening the sample file. Behavior of each version and of the sample file is collected while each version is executing. A score indicating malicious behavior for each version with respect to the sample file is determined and reported. The versions may execute serially in the happening system, each version terminating before the next version begins executing. Or, all versions may execute concurrently within the operating system. Files and registries are hidden to facilitate installation. System information is changed to facilitate execution.