Time Controller Malware Detection via Time Dilation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems face challenges in effectively detecting delayed activation malware, as these malicious programs employ defensive strategies to delay their execution, making it difficult for virtual machines to detect their presence within a sandbox environment.
Innovation Solution
The proposed solution involves a malware content detection system that manipulates time by using a time controller operating within a computer runtime environment, which intercepts and alters time checks made by malware, convincing it that a longer delay has passed than actually elapsed, thereby triggering the malware's activation and allowing for detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a virtual machine exercises malware specimens for a finite amount of time to analyze as many specimens as possible, then productivity is improved, but delayed activation malware can bypass detection by delaying their execution
Solution Approach 1:
The system dynamically changes the time parameter by introducing a time controller that manipulates the passage of time within the virtual machine environment. When delayed activation malware is detected (through time check interceptions), the system accelerates time passage to force the malware's delayed execution to occur within the shortened analysis window, thereby resolving the contradiction between fast analysis and reliable detection
2Difficulty of detecting and measuring
If the virtual machine environment makes actions invisible to malware to prevent detection of the sandbox, then the malware cannot detect it is being processed in a sandbox, but this makes it harder to detect malware that uses time-based defensive strategies
Solution Approach 1:
The time controller acts as an intermediary component between the virtual machine environment and the malware. It intercepts time checks made by malware and manipulates the time values returned, thereby controlling the passage of time without the malware detecting the sandbox environment. This allows the system to maintain sandbox invisibility while simultaneously enabling detection of time-based defensive strategies
Data Source
AI summary
A malicious content detection (MCD) system and a computerized method for manipulating time uses two or more time controllers operating within the MCD system in order to capture the behavior of delayed activation malware (time bombs). Each time controller may include a monitoring agent located in a software layer of a computer runtime environment configured to intercept software calls (e.g., API calls or system calls) and/or other time checks that seek to obtain a “current time,” and time-dilation action logic located in a different layer (e.g., a hypervisor layer) configured to respond to the software calls by providing a “false” current time that indicates considerably more time has transpired than the real clock. Additionally, a primary controller may be used in some embodiments to configure and manage, the time controllers.