Virtual Machine Execution Log for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious files in virtual machines do not effectively capture the execution process of files with vulnerabilities, leading to missed detection of malicious activity, especially when malicious programs exploit vulnerabilities in other applications or components, and fail to identify malicious behavior when the wrong version of a vulnerable application is installed.
Innovation Solution
A system and method that discovers triggers during the execution of a file in a virtual machine, analyzes the stack of function calls, and logs information when conditions related to vulnerability exploitation are met, including API calls, system calls, and memory events, to form an execution log that captures potential exploitation attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional virtual machine execution methods are used to analyze files, then the execution environment is isolated and safe, but malicious activity is not detected when the wrong version of a vulnerable application is installed or when exploitation conditions are not met
Solution Approach 1:
The system performs preliminary analysis of the file to identify vulnerability exploitation attempts before full execution, and prepares trigger conditions in advance that will log relevant events. This allows the system to detect potential malicious activity even when the exploitation cannot be fully completed due to version mismatches or missing conditions.
Solution Approach 2:
The patent introduces an intermediary logging mechanism that captures API calls, system calls, and memory events as triggers during file execution. This intermediary layer records evidence of exploitation attempts without requiring the actual exploitation to succeed, enabling detection of malicious intent even when conditions prevent full exploitation.
2Loss of information
If the system logs all API calls and events during file execution, then comprehensive detection data is collected, but the complexity of analyzing and processing the log data increases significantly
Solution Approach 1:
Instead of uniformly logging all events, the system applies local quality by selectively logging only those events that match predefined trigger conditions related to vulnerability exploitation. This includes specific API calls, system calls, and memory events that indicate potential malicious activity, reducing log volume while maintaining detection effectiveness.
Solution Approach 2:
The logging system is segmented into different trigger types (API calls, system calls, memory events) with specific conditions for each. This segmentation allows the system to process and analyze different types of events separately, reducing overall complexity while maintaining comprehensive coverage of exploitation attempts.
3Reliability
If the malicious program is allowed to execute fully to manifest harmful activity, then detection is more reliable, but the execution time increases and the program may sleep or delay malicious actions
Solution Approach 1:
The system performs preliminary detection of exploitation attempts during the early stages of file execution by monitoring for specific trigger conditions. This allows detection to occur before the malicious program can sleep or delay its harmful actions, reducing execution time while maintaining reliability through early identification of malicious intent.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for forming a log during an execution of a file with vulnerabilities. In one example, an exemplary method comprises, discovering an activation of a trigger during an execution of a thread of a process created upon opening the file, wherein the trigger describes conditions accompanying an event which relates to an attempt to exploit a vulnerability of the file, analyzing a stack of the process created upon opening the file, and discovering a chain of function calls preceding the event in a form of a sequence of call and return addresses, analyzing the discovered chain of function calls for fulfillment of conditions of the trigger which relate to the attempt to exploit the vulnerability, and when the conditions of the trigger are fulfilled, saving information about the chain of function calls in a log.