Virtual Machine Antivirus Scan Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus methods, including signature analysis and virtual machine scans, are ineffective in detecting polymorphic viruses and modified malicious files due to performance slowdowns and evasion techniques employed by hackers, such as long-running API function calls.
Innovation Solution
A system and method that involves multiple executions of a file on a virtual machine, with each execution logging API function calls and internal events, and using databases to classify files as malicious or not, with dynamic timing adjustments and focused logging to enhance detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the file execution time on the virtual machine is extended to detect malicious code, then the detection accuracy is improved, but the performance impact and execution time increase significantly
Solution Approach 1:
The patent segments the file execution process into multiple separate executions on the virtual machine, each with a limited time interval. Instead of running the file continuously for a long duration, the system performs multiple shorter executions, analyzing the cumulative behavior across all runs to detect malicious code while keeping each individual execution time short.
Solution Approach 2:
The system employs periodic execution of the file on the virtual machine rather than continuous execution. By repeatedly running the file in periodic intervals and analyzing the aggregated logs from multiple executions, the system achieves high detection accuracy without requiring each execution to run for an extended continuous period.
2Productivity
If traditional signature analysis is used to detect malicious files, then the scanning speed is maintained, but polymorphic viruses and modified malicious files cannot be detected
Solution Approach 1:
The patent introduces a virtual machine as an intermediary between the file being analyzed and the detection system. Instead of directly analyzing file signatures or statically examining the code, the system executes the file within a virtualized environment and observes its runtime behavior through logged API function calls. This intermediary approach enables detection of polymorphic and modified malicious files while maintaining scanning efficiency.
3Object-affected harmful factors
If hackers add code with long-running API function calls to evade detection, then the file execution time on the virtual machine elapses before malicious code executes, but this requires sophisticated evasion techniques
Solution Approach 1:
The system dynamically adjusts the analysis approach based on observed behavior across multiple executions. By performing multiple file executions and analyzing the cumulative log data, the system can distinguish between legitimate long-running API calls and malicious evasion techniques. The dynamic analysis adapts to different file behaviors without requiring predetermined rules for each evasion method.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system are provided for performing an antivirus scan of a file on a virtual machine. An example method includes performing a first execution of the file on the virtual machine, recording a first log that includes an API function call and an internal event detected during execution, and determining if any signatures in the log are stored in a signatures database. Moreover, if no signatures in the first log are found in the first database of signatures, the file is classified as not malicious. In contrast, if at least one signature is found, a second execution of the file is perform and a second log is recorded that includes a detected internal event. Moreover, the method includes determining if any signatures in the second log are stored in a second database of signatures; and classifying the file as not malicious if no signatures are found.