Virtual Machine Execution Log for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious files in virtual machines do not effectively capture the execution process, allowing malicious software to exploit vulnerabilities without immediate detection, especially when the malicious program does not manifest harmful activity immediately or when using vulnerabilities of other programs or components.
Innovation Solution
A system and method that discovers and logs activation of triggers related to vulnerability exploitation during file execution in a virtual machine by analyzing the stack of function calls and saving information about chains of function calls that fulfill specific conditions, including API function calls and system calls, to identify potential exploitation attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature and heuristic analysis are used to identify malicious software, then the analysis process is simple and fast, but malicious software can evade detection through obfuscation and resistance mechanisms
Solution Approach 1:
The patent introduces a virtual machine as an intermediary environment to execute the analyzed file. This mediator isolates the execution from the host system, allowing safe observation of malicious behavior without direct exposure. The virtual machine captures API function calls and system calls as evidence, enabling detection of obfuscated malware that would evade traditional signature-based methods.
Solution Approach 2:
The patent replaces traditional mechanical analysis methods (signature matching, heuristic rules) with a dynamic execution-based approach. Instead of statically analyzing file characteristics, the system dynamically executes the file in a controlled virtual environment and observes its behavior, substituting static analysis with dynamic behavioral monitoring to detect sophisticated malware.
2Reliability
If the virtual machine executes and logs all API function calls during file execution, then comprehensive detection coverage is achieved, but the execution time and computational resources increase significantly
Solution Approach 1:
The patent extracts only the essential execution evidence needed for detection - specifically API function calls and system calls - from the complete execution trace. By filtering and capturing only these critical events rather than logging all possible execution details, the system achieves comprehensive detection coverage while minimizing the time and computational overhead associated with full execution monitoring.
3Reliability
If the malicious program uses vulnerabilities of other programs or components, then the attack becomes more sophisticated and harder to detect, but the vulnerable programs must be present on the system for the attack to succeed
Solution Approach 1:
The patent performs preliminary installation of vulnerable programs and components into the virtual machine environment before executing the analyzed file. This preliminary setup ensures that if the malware attempts to exploit vulnerabilities, the vulnerable targets are already present in the controlled environment, allowing the system to detect exploitation attempts without requiring the actual host system to be vulnerable or modified.
Data Source
AI summary
Disclosed herein are systems and methods for forming a log during an execution of a file with vulnerabilities. In one aspect, an exemplary method comprises, discovering an activation of a trigger during an execution of a thread of a process created upon opening the file, wherein the trigger describes conditions accompanying an event which relates to an attempt to exploit a vulnerability of the file, analyzing a stack of the process created upon opening the file, and discovering a chain of function calls preceding the event in a form of a sequence of call and return addresses, analyzing the discovered chain of function calls for fulfillment of conditions of the trigger which relate to the attempt to exploit the vulnerability, and when the conditions of the trigger are fulfilled, saving information about the chain of function calls in a log.