Virtual Machine MBR Detection for Bootkit Viruses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security software struggles to detect deformed malicious programs, especially MBR-based Bootkit viruses, as they use junk or deformation codes that bypass traditional characteristic code detection methods.
Innovation Solution
A method and apparatus that simulate the execution of the MBR in virtual memory using a virtual CPU and virtual hard disk, detecting modifications to the virtual memory to identify malicious programs without relying on characteristic code detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional characteristic code detection is used, then simple viruses can be detected, but deformed malicious programs (such as MBR-based Bootkit viruses using junk or deformation codes) cannot be detected
Solution Approach 1:
The patent creates a virtual copy of the MBR (Master Boot Record) in virtual memory and simulates its execution in a controlled environment. Instead of directly analyzing the MBR code for characteristic patterns, the system copies the MBR to a virtual disk image and executes it in a virtual machine, allowing observation of actual behavior rather than relying on code pattern matching. This enables detection of deformed viruses that modify their characteristic codes while maintaining the same functional behavior.
2Productivity
If characteristic code detection is used, then detection speed is fast, but detection of deformed viruses is impossible
Solution Approach 1:
The patent introduces a virtual machine as an intermediary layer between the MBR execution and the detection system. The virtual machine acts as a mediator that executes the MBR in a controlled, isolated environment and captures its behavior. This intermediary approach allows the system to maintain fast detection speeds while achieving reliable detection of deformed viruses, as the virtual machine can efficiently simulate CPU execution and memory operations without requiring complex code analysis.
3Reliability
If virtual memory simulation is used to detect MBR viruses, then deformed viruses can be detected, but system resources are consumed
Solution Approach 1:
The patent segments the detection process into distinct virtualized components: a virtual CPU that simulates instruction execution, a virtual memory system that provides isolated execution space, and a virtual disk that stores the MBR image. This segmentation allows the detection system to allocate resources only when needed for simulation, rather than continuously consuming system resources. The virtualized environment can be activated on-demand for suspicious MBRs and deactivated when not in use, reducing overall resource consumption while maintaining reliable detection capability.
Data Source
AI summary
A method, an apparatus and a virtual machine for detecting a malicious program(s) are disclosed. The method comprises: setting a virtual memory (301); reading a Master Boot Record (MBR) and storing the MBR in the virtual memory (302); and executing each instruction of the MBR in the virtual memory simulatedly, and detecting whether the virtual memory is modified after executing each instruction (303); if so, a malicious program is found, otherwise, continuing to execute the next instruction simulatedly until completing simulation execution of all instructions of the MBR. The technical solution can find the deformed malicious program(s).