Virtual Machine Log Analysis for Malicious File Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems fail to detect malicious files that do not immediately exhibit harmful behavior, as they can execute without being noticed on high-performance devices with multicore processors, using techniques like obfuscation and emulation to evade detection within virtual machines.
Innovation Solution
A system and method for analyzing a log during an antivirus scan in a virtual machine, where a file is opened, and its execution is intercepted to save events and context data, allowing analysis using templates with rules to determine harmfulness, enabling influence on the execution process and detection of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a file is executed in a virtual machine for antivirus analysis, then the system can intercept events and actions during execution, but the malicious software may complete its execution or stop working before manifesting harmful activity
Solution Approach 1:
The system performs preliminary actions by injecting a debugger into the virtual machine before the malicious file executes. This debugger establishes early monitoring capabilities, allowing the system to track API function calls and system events from the moment the file starts executing, rather than waiting for harmful behavior to manifest.
Solution Approach 2:
The system implements continuous feedback mechanisms where the debugger monitors execution in real-time, intercepts API calls, and dynamically adjusts analysis based on observed behavior. This feedback loop allows the system to identify malicious patterns even if the file attempts to stop working or complete execution quickly.
2Difficulty of detecting and measuring
If malicious software uses obfuscation techniques to hide its code, then it becomes harder to analyze the working algorithms, but the file still performs millions of API function calls and cycles
Solution Approach 1:
The debugger acts as an intermediary between the malicious file and the analysis system. Instead of directly analyzing obfuscated code, the debugger intercepts API function calls and system events, providing a readable trail of actual runtime behavior that bypasses code obfuscation barriers.
Solution Approach 2:
The system replaces direct code analysis (mechanical examination of obfuscated text) with behavioral monitoring through API interception. This substitution allows the system to analyze what the code actually does rather than attempting to decode what it says, effectively bypassing obfuscation techniques.
3Adaptability or versatility
If malicious software uses emulation counteracting mechanisms to recognize when it is being executed in an emulator, then it can avoid manifesting malicious activity, but the system needs to intercept functions to detect behavior
Solution Approach 1:
The system uses the malicious file's own execution environment (the virtual machine) to detect its behavior. The debugger operates within the same virtualized environment, allowing the file to believe it is running normally while the debugger secretly monitors and intercepts its API calls, making the detection system self-sufficient and hard to distinguish from legitimate operation.
Data Source
AI summary
Disclosed is a method for analyzing a log for conducting an antivirus scan of a file. The method includes opening a file in a virtual machine. The opening of the file includes execution of a guest process having a thread in a virtual processor of the virtual machine. A plurality of events in the thread of the guest process is intercepted. Registers associated with a system call made during execution of the first thread of the guest process are determined. Execution of the thread of the guest process is halted. In a log associated with the opening of the file, information is saved indicating events intercepted during execution of the thread in an altered guest physical memory page, and context data of the virtual processor. Using at least one template having rules, the saved log is analyzed to determine whether the file opened in the virtual machine is harmful.