Virtual Machine Kill-Chain Tracking for Malware Root-Cause Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems struggle to identify and mitigate the full extent of malicious file propagation through complex kill chains, often failing to detect the root cause of the attack due to obfuscation techniques employed by malware, leading to potential unauthorized processing and spread of malicious content.
Innovation Solution
A system that utilizes a chain of virtual machines (VMs) to track and record parent-child relationships, allowing for the identification and automatic marking of VMs and associated files/URLs within a kill chain, thereby facilitating rapid response and prevention of further malicious processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anti-malware detection methods are used, then detection speed is maintained, but the ability to identify root cause of attacks deteriorates due to obfuscation techniques
Solution Approach 1:
The system performs preliminary actions by creating and executing suspicious files in isolated virtual machine environments before they can cause harm to the host system. This advance preparation allows the system to observe malicious behavior patterns and identify root causes of attacks before deployment, resolving the contradiction between detection accuracy and time to identify root cause.
Solution Approach 2:
The system segments the analysis process by dividing it into distinct virtual machine instances, each handling specific suspicious files or behaviors. This segmentation allows parallel analysis of multiple threats simultaneously, improving both detection accuracy and reducing the time required to identify root causes by distributing the analytical workload across isolated environments.
2Reliability
If virtual machine isolation is used to prevent malware execution, then system security is improved, but the complexity of tracking and identifying malicious files deteriorates
Solution Approach 1:
The system implements feedback mechanisms by continuously monitoring virtual machine environments for malicious behaviors and automatically feeding this information back to update detection rules and threat intelligence. This closed-loop feedback system simplifies tracking of malicious files by automatically learning from observed patterns, resolving the contradiction between security reliability and tracking complexity.
Solution Approach 2:
The system uses virtual machine environments as intermediaries between the host system and malicious files. These VMs act as controlled mediators that allow safe execution and analysis of suspicious code while automatically tracking and reporting back information about malicious behaviors, thereby simplifying the complexity of tracking malicious files while maintaining security isolation.
3Measurement precision
If comprehensive analysis of all suspicious files is performed, then detection accuracy is improved, but processing time and system resources deteriorate
Solution Approach 1:
The system applies partial analysis by initially performing lightweight static analysis on all suspicious files, then selectively applying more resource-intensive dynamic analysis only to files that exhibit suspicious characteristics in the preliminary screening. This partial action approach maintains high detection accuracy for critical threats while preserving processing throughput by avoiding exhaustive analysis of all files.
Solution Approach 2:
The system applies different analysis depths to different files based on their local characteristics and risk profiles. High-risk files receive comprehensive analysis with multiple virtual machine instances, while lower-risk files receive streamlined analysis. This local quality differentiation maintains detection accuracy for critical threats while optimizing overall processing throughput by allocating resources proportionally to risk levels.
Data Source
AI summary
An example storage medium stores instructions that, when executed, cause a processor of a computing device to receive an indication associated with a first virtual machine, the first virtual machine containing a first application, the indication indicating that a first operation in the first virtual machine is to use a second application; receive information associated with a second virtual machine, the second virtual machine created in response to the first operation and containing the second application; store information describing a chain of virtual machines, the chain of virtual machines including the first and second virtual machines, the stored information including a relationship between the first virtual machine and the second virtual machine, based on the received indication and the received information; and in response to an identification of malware in the chain of virtual machines, identify a particular virtual machine in the chain of virtual machines that is in a kill chain of the malware based on the stored information.