Virtual Machine Data Extraction for Malware Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems face inefficiencies in data management and analysis time due to complex and I/O-intensive processes when transferring malware analysis results from a virtualized guest system to a host system, particularly after a potential crash, which can result in data unavailability.
Innovation Solution
A data extraction system that includes event monitoring logic, data availability logic, and data access logic, allowing for the selective storage and retrieval of post-analysis data from a virtual image file, avoiding the need to mount the entire guest file system, and enabling quicker access to malware analysis results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the conventional mounting scheme is used to copy the entire virtual file system contents to host system memory, then the host system is provided with the ability to access malware analysis results, but the process becomes extremely I/O intensive and reduces the time reserved for malware analysis
Solution Approach 1:
The patent extracts only the specific post-crash data that is needed for malware analysis from the virtual file system, rather than copying the entire file system. The data extraction module identifies and extracts only the relevant data portions, significantly reducing I/O operations while ensuring the host system receives the necessary malware analysis results.
Solution Approach 2:
The patent segments the data extraction process into specific identifiable portions. The virtual file system is divided into relevant and irrelevant sections, and only the relevant segments containing post-crash malware analysis data are extracted and transferred to the host system, avoiding the need to process the entire file system.
2Reliability
If the conventional mounting scheme is used to copy the entire virtual file system contents to host system memory, then the host system is provided with the ability to access malware analysis results, but the complexity of the data management process increases
Solution Approach 1:
The patent removes the complex mounting operation entirely and replaces it with a direct extraction mechanism. Instead of mounting the entire virtual file system and managing complex I/O operations, the data extraction module directly extracts only the necessary post-crash data and makes it available to the host system through simplified interfaces.
3Productivity
If the guest system conducts malware analysis, then the analysis results are obtained, but after a crash the information needed for accessing the malware analysis results is no longer available to the host system unless preventative measures are undertaken
Solution Approach 1:
The patent implements preliminary action by having the data extraction module continuously monitor and identify post-crash data during the malware analysis process, before any crash occurs. This preparatory identification ensures that when a crash happens, the necessary data has already been marked for extraction and can be quickly retrieved without loss of information.
Solution Approach 2:
The patent provides beforehand cushioning by implementing a protection mechanism that identifies and secures critical malware analysis data during the analysis process. This cushioning ensures that even if a crash occurs, the identified data remains protected and available for extraction, preventing data loss that would otherwise occur after a crash.
Data Source
AI summary
According to one embodiment, a computerized method features monitoring behaviors of an object during processing within a guest system of a virtual machine. Within a guest system, a rule-based analysis of data associated with the monitored behaviors is conducted. The rule-based analysis includes prioritizing data associated with the monitored behaviors that correspond to an exception, and thereafter, storing the data associated with the monitored behaviors that correspond to the exception into a prescribed area of a virtual image file. The prescribed area is accessible by (i) logic within the guest system and (ii) logic within a host system of the virtual machine.