Virtualized Threat Detection With Rollback for Client Hosts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are slow and resource-intensive, making it difficult to scale on large numbers of client hosts and impacting user experience.
Innovation Solution
Utilizing virtualization or emulation, such as hardware virtualization (e.g., Hyper-V) or software emulation, to execute a virtual copy of the operating system on a local machine or server, analyzing application behavior in a virtual machine or emulator to detect malicious activity, and reverting changes made to the system if detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware detection is performed by running the application in a managed environment to analyze application activity, then detection accuracy is improved, but processing time increases and resource consumption increases
Solution Approach 1:
The patent performs preliminary static analysis of the application binary code before execution to extract features, identify suspicious patterns, and prepare detection data structures. This preliminary processing reduces the complexity and time required for subsequent dynamic analysis in the managed environment, enabling faster while accurate malware detection.
2Measurement precision
If malware detection is performed by running the application in a managed environment to analyze application activity, then detection accuracy is improved, but resource consumption increases
Solution Approach 1:
The detection system is segmented into multiple specialized components: a static analysis module that processes binary code independently, a dynamic analysis module that runs in the managed environment, and a decision module that synthesizes results. This segmentation allows resource-intensive operations to be distributed and optimized, reducing overall resource consumption while maintaining high detection accuracy.
Solution Approach 2:
The system performs partial dynamic analysis by monitoring only critical system calls and application behaviors rather than complete execution. It uses selective instrumentation that tracks only suspicious patterns identified during static analysis, reducing resource consumption while maintaining detection effectiveness for malicious activities.
3Reliability
If traditional malware scanning is performed on large numbers of client hosts, then detection coverage is improved, but scalability deteriorates due to resource constraints
Solution Approach 1:
The patent creates virtual copies (sandboxed instances) of the application in a controlled managed environment for analysis. Instead of analyzing every application directly on every client host, the system uses virtualized copies that isolate resource consumption, enabling parallel analysis of multiple applications across numerous hosts without proportionally increasing overall system resource demands, thus improving scalability while maintaining detection coverage.
Data Source
AI summary
An arrangement and method of threat detection in a computer or computer network in which a virtual machine or a software emulator is initialized in response to starting a software application at a local machine. The software application is passed to and started at the virtual machine or software emulator, and changes made by the software application run on the local machine to at least one file and/or system configuration value of the local machine are determined and backed-up. Application events and/or behavior is analyzed at the virtual machine or software emulator to determine malicious behavior of the application. The local machine is notified about the malicious behavior and the virtual machine or software emulator session is ended. Based on receiving the notification, the software application at the local machine is terminated and changes are reverted based on the backed-up version of at least one file and/or system configuration value.