Virtual Machine File Analysis with Real-Time Thread Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems that use virtual machines for analyzing files for maliciousness are ineffective in detecting malicious activity during execution, as they do not influence the execution process in real-time, allowing malicious files to hide their behavior by halting or delaying their actions, which can go unnoticed in multi-core processors with high performance.
Innovation Solution
The method involves intercepting events in a virtual machine by reading processor register values and stack data to compare against predefined rules, allowing for real-time analysis and halting or modifying the execution of potentially malicious threads, enabling immediate detection of malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual machines are used for analyzing files for maliciousness, then files can be executed in an isolated environment for safe analysis, but the execution process cannot be influenced in real-time, allowing malicious files to hide their behavior by halting or delaying actions
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously monitors execution events, compares them against predefined rules, and dynamically adjusts the execution process in real-time. When malicious behavior is detected, the system immediately responds by halting execution or modifying the virtual machine environment, creating a closed-loop feedback system that actively influences the execution process rather than passively observing it.
Solution Approach 2:
The patent employs preliminary action by establishing predefined rules and thresholds before execution begins. These rules are set up in advance to recognize specific malicious patterns, allowing the system to be prepared for detection rather than reacting after damage occurs. The rules are configured beforehand to trigger immediate responses when specific conditions are met during execution.
2Adaptability or versatility
If malicious programs perform millions of API function calls and billions of cycles, then they can evade detection by normal users, but the system cannot distinguish between legitimate high-performance execution and malicious activity
Solution Approach 1:
The patent applies local quality by examining specific local characteristics of execution events rather than treating all execution uniformly. The system analyzes individual API calls, system calls, and execution patterns with specialized detection rules tailored to each type of operation. This allows the system to identify malicious behavior in specific execution contexts even when overall performance metrics appear normal.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the execution process and the detection system. This intermediary component captures execution events, contextualizes them against predefined rules, and filters out legitimate high-performance operations from malicious activity. The intermediary acts as a mediator that translates raw execution data into meaningful security assessments, making it possible to distinguish between benign high-performance execution and malicious behavior.
3Measurement precision
If security applications use signature and heuristic analysis technologies, then files can be screened before execution, but files without digital signatures or with obfuscated code cannot be reliably detected
Solution Approach 1:
The patent replaces traditional mechanical analysis methods (signature matching and static heuristic scanning) with a dynamic execution-based approach. Instead of relying on pre-computed signatures or static code analysis, the system substitutes these with real-time monitoring of execution behavior, system calls, and runtime events. This substitution allows detection of obfuscated and unsigned code by observing what the code actually does during execution rather than how it looks statically.
Solution Approach 2:
The patent employs parameter changes by transforming the detection parameters from static code characteristics to dynamic execution parameters. Rather than analyzing fixed code patterns or digital signatures, the system monitors changing parameters during execution such as API call sequences, memory access patterns, CPU cycle consumption, and system event timing. These dynamic parameters allow the system to adapt to code obfuscation and polymorphic variations while maintaining detection accuracy.
Data Source
AI summary
Disclosed are systems and methods for analysis of files for maliciousness and determining an action. An exemplary method comprises: opening a file, by a processor, in a virtual machine, intercepting an event arising in an execution of a thread of a process created upon opening of the file, determining, a context of the processor on which the thread is being executed, the determination including reading register values of the processor and a stack, comparing the context with rules that check: a behavior of the thread of the process, a changing, by the thread, of attributes of the file, and an access of the thread to the Internet, and based on a result of the comparison, performing at least one of: recognizing the file as being malicious, halting the execution of the thread, changing the context of the processor, and waiting for a next intercepted event.