Virtualization Emulation Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy security solutions are ineffective in detecting sophisticated, armored, and component-based malware that employs coordinated activity, as they rely on signature matching and isolated behavioral analysis, failing to detect future coordinated attacks.
Innovation Solution
The system employs virtualization and emulation techniques to intercept and process objects, determining required resources, monitoring operations, and generating reports on untrusted actions, including the use of heuristic processes and metadata analysis to identify vulnerabilities and generate signatures for malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If legacy security solutions use signature and heuristics matching to detect malware, then detection speed is improved, but detection accuracy against sophisticated armored malware deteriorates
Solution Approach 1:
The system performs preliminary actions by instantiating a virtual environment with required resources before executing the intercepted object. This allows the malware to be analyzed in a controlled setting where its behavior can be monitored and compared against expected patterns, enabling detection of sophisticated armored malware that would evade traditional signature-based detection.
Solution Approach 2:
The patent introduces a virtual environment as an intermediary between the intercepted object and the analysis system. This intermediary layer allows the malware to execute in isolation while its operations are monitored and compared against a model of legitimate behavior, enabling detection without direct interaction with the host system and improving both accuracy and speed.
2Reliability
If legacy security solutions analyze agent behavior in an isolated context, then security of the target system is improved, but ability to detect coordinated attacks deteriorates
Solution Approach 1:
The system implements feedback by comparing the actual operations of the intercepted object against a model of expected legitimate behavior. When discrepancies are detected, the system can identify potential coordinated attacks even in isolated analysis, maintaining security while improving detection capability through continuous comparison and learning from observed behaviors.
Solution Approach 2:
The patent applies dynamics by making the analysis approach adaptive rather than static. The system dynamically adjusts its monitoring and comparison based on the behavior observed during execution, allowing it to detect coordinated attacks by identifying patterns that deviate from legitimate behavior while maintaining isolated analysis for security.
3Measurement precision
If the virtual environment includes all required resources for the object, then completeness of analysis is improved, but resource consumption and complexity deteriorates
Solution Approach 1:
The system segments the virtual environment into distinct components based on the specific resources required by the intercepted object. Rather than creating a complete replica of the target system, the virtual environment is divided into only those necessary elements, reducing complexity while maintaining analysis completeness for the specific malware being examined.
Solution Approach 2:
The patent applies local quality by tailoring the virtual environment to the specific requirements of each intercepted object. Each analysis creates a customized virtual environment with the precise resources needed for that particular malware, rather than using a generic comprehensive environment, thereby reducing overall system complexity while maintaining local completeness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for virtualization and emulation malware enabled detection are described. In some embodiments, a method comprises intercepting an object, instantiating and processing the object in a virtualization environment, tracing operations of the object while processing within the virtualization environment, detecting suspicious behavior associated with the object, instantiating an emulation environment in response to the detected suspicious behavior, processing, recording responses to, and tracing operations of the object within the emulation environment, detecting a divergence between the traced operations of the object within the virtualization environment to the traced operations of the object within the emulation environment, re-instantiating the virtualization environment, providing the recorded response from the emulation environment to the object in the virtualization environment, monitoring the operations of the object within the re-instantiation of the virtualization environment, identifying untrusted actions from the monitored operations, and generating a report regarding the identified untrusted actions of the object.