Virtual Container Sandboxes for Targeted Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Traditional malware detection systems face challenges in identifying targeted malware attacks due to the difficulty in replicating the exact configuration of target endpoints, leading to ineffective sandbox environments that may not accurately simulate the conditions of the intended target systems.

Innovation Solution

The method involves creating virtual containers within a virtual machine image to replicate the configuration of a target computing system by identifying and activating applications installed on the system, allowing for analysis of how a potentially malicious file would impact the target system without exposing it to actual threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple sandbox environments are maintained to replicate different endpoint configurations, then detection accuracy is improved, but device complexity and cost increase significantly

Engineering Contradiction:

Improvedetection accuracyVSAvoidnumber of sandbox environments

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the sandbox environment into a single base virtual machine image with multiple configurable virtual containers. Each virtual container represents a different endpoint configuration (e.g., different applications, versions, or configurations) that can be selectively activated within the same sandbox instance, eliminating the need for multiple separate sandbox environments.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The sandbox environment becomes dynamic through the ability to activate different virtual containers based on the target endpoint configuration. The system can adaptively configure the sandbox by selecting and activating appropriate virtual containers to match the specific endpoint being analyzed, allowing one sandbox to serve multiple configuration scenarios.

Inventive Principle:

Principle #15Dynamics

2Reliability

If multiple sandbox environments are maintained to replicate different endpoint configurations, then detection accuracy is improved, but resource consumption and cost increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A single sandbox environment serves multiple functions by accommodating different endpoint configurations through virtual containers. The sandbox can be configured to simulate various endpoint scenarios (different applications, versions, configurations) without requiring separate dedicated sandbox instances for each configuration type.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Device complexity

If traditional signature-based malware detection is used, then system simplicity is maintained, but detection capability for targeted malware attacks deteriorates

Engineering Contradiction:

Improvedetection system simplicityVSAvoidtargeted malware detection capability

Core Design Contradiction:

Device complexityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces a virtual machine sandbox environment as an intermediary between the malware analysis system and the target endpoint. This intermediary sandbox replicates the target endpoint's configuration (including applications, versions, and system state) to safely execute and observe malware behavior, enabling detection of targeted attacks without direct exposure of the actual target system.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a copy of the target endpoint's configuration within the sandbox environment by activating appropriate virtual containers that replicate the endpoint's applications, versions, and system state. This copy allows safe malware execution and analysis while maintaining the necessary contextual information for accurate detection.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS9223966B1Systems and methods for replicating computing system environments

Publication Date: 2015.12.29 CA TECH INC

AI summary

The disclosed computer-implemented method for replicating computing system environments may include (1) identifying each application installed on a plurality of computing systems, (2) creating, within a virtual machine image, virtual containers that store each application installed on the plurality of computing systems, (3) determining that a potentially malicious file is directed to a target computing system within the plurality of computing systems, (4) identifying each application installed on the target computing system, (5) in response to determining that the file is directed to the target computing system, replicating a configuration of the target computing system within the virtual machine image by, for each application installed on the target computing system, activating a virtual container that stores the application, and (6) determining how the file would affect the target computing system by sending the file to the virtual machine image and analyzing how the file impacts the virtual machine image.