Malicious URL Detection via Virtual Machine Snapshot Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malicious URL detection methods have low accuracy as they only perform static analysis on web page code, failing to assess linked information, which can lead to incorrect determinations and potential system threats.
Innovation Solution
A method involving a virtual machine that rolls back to an initiating state, loads page content, runs linked applications, and takes system snapshots at different states to perform dynamic analysis, determining security levels based on modification traces, thereby enhancing detection accuracy without affecting the host operating system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis is performed on web page code only, then detection speed is maintained, but detection accuracy deteriorates due to inability to assess linked information
Solution Approach 1:
A virtual machine is introduced as an intermediary environment to execute application programs linked to the web page. The virtual machine isolates the execution from the host system, allowing dynamic analysis of linked content without directly compromising system safety. This mediator enables comprehensive security assessment while maintaining system stability.
Solution Approach 2:
The detection process is segmented into multiple independent phases: static analysis of web page code, dynamic analysis of linked application programs in virtual machine, and aggregation of results. This segmentation allows each component to be optimized independently and facilitates comprehensive detection without overwhelming system complexity.
2Measurement precision
If dynamic analysis of linked applications is performed, then detection accuracy improves, but system security risk increases due to potential malicious impacts
Solution Approach 1:
The virtual machine serves as a protective intermediary between the host system and potentially malicious application programs. By executing linked content in this isolated environment, the system can perform dynamic analysis to detect malicious behavior while preventing direct harm to the host operating system through virtualization isolation mechanisms.
Solution Approach 2:
The system prepares a controlled virtual environment beforehand where malicious content can be safely executed. This pre-established protective layer acts as a cushion, absorbing potential harmful effects before they can reach the host system, thereby enabling comprehensive dynamic analysis without exposing the main system to risks.
3Measurement precision
If multiple system snapshots are taken at different states, then analysis comprehensiveness improves, but processing time increases
Solution Approach 1:
System snapshots are captured at predetermined critical states during the execution process (initial state, post-webpage-loading state, post-application-execution state). This preliminary planning of snapshot timing ensures comprehensive security assessment at key moments without requiring continuous monitoring, thereby reducing overall processing time while maintaining analysis completeness.
Data Source
AI summary
A malicious URL detection method, apparatus, and storage medium are provided. The method includes rolling back a virtual machine to an initiating state in response to detecting a trigger event of the virtual machine. In the initiating state, page content of a target URL is loaded using the virtual machine. Using the virtual machine, an application program linked to the page content is run. A system snapshot file of the virtual machine is obtained in at least one state of the initiating state, a state in which the loading of the page content is completed, or a state in which the application program is being run. Malicious URL detection is performed on the target URL based on the obtained system snapshot file.