Untrusted File Sandbox Merging for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for testing untrusted digital files for malware in a sandbox environment are resource-intensive and inefficient, as they require running each file individually, even after malicious activity is detected, to gather complete logs for analysis.
Innovation Solution
Simultaneously running multiple untrusted digital files in a reduced number of sandboxes, monitoring for malicious activity, and iteratively dividing subsets upon detection to isolate malicious files, allowing for efficient identification and further inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple untrusted digital files are run simultaneously in separate sandboxes, then the throughput of malware testing is improved, but the system resource usage, especially memory, increases significantly
Solution Approach 1:
The patent merges multiple sandbox executions into a single sandbox by running multiple untrusted digital files simultaneously. The sandbox is configured to execute batches of files (e.g., 10-100 files) in parallel within the same isolated environment, allowing the system to test multiple files without proportionally increasing memory allocation. This combining approach maintains high throughput while controlling resource consumption.
Solution Approach 2:
The patent implements dynamic sandbox management where the sandbox environment is reused across multiple file executions. Instead of creating static, separate sandboxes for each file, the system dynamically configures and reconfigures a single sandbox to handle batches of files, adjusting resources as needed based on the current batch being processed. This dynamic approach optimizes resource utilization while maintaining testing effectiveness.
2Loss of information
If untrusted digital files are run to completion even after malicious activity is detected, then complete logs for analysis are obtained, but the testing time increases
Solution Approach 1:
The patent applies preliminary action by implementing early termination logic that monitors file execution in real-time and stops the sandbox session as soon as malicious activity is detected. This prevents unnecessary continuation of benign or already-compromised file executions, saving time while preserving complete logs of the malicious behavior that was observed. The system captures sufficient diagnostic information before termination to maintain analysis quality.
Solution Approach 2:
The patent implements skipping by allowing the system to rush through the testing process of files that have already demonstrated malicious behavior. Once a file is identified as malicious through monitored activity, the system skips the remaining execution time that would be wasted on clearly harmful files, while still maintaining complete logs of the malicious actions for security analysis purposes.
Data Source
AI summary
A plurality of untrusted digital files are run simultaneously in fewer sandboxes than there are files, while monitoring for malicious activity. Preferably, only one sandbox is used. If the monitoring detects malicious activity, either the files are run again in individual sandboxes, or the files are divided among subsets whose files are run simultaneously in one or more sandboxes, while monitoring for malicious activity.