Single VM Multi-Version Malware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing malware detection systems face inefficiencies in testing multiple versions of software applications, leading to prolonged resource usage and potential false negatives due to limited virtual machine resources and the inability to detect polymorphic malware effectively.

Innovation Solution

Concurrently installing and testing multiple versions of a software application within a single virtual machine to identify anomalous behavior indicative of malware, reducing the need for multiple virtual machine instances and enhancing detection capabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If multiple virtual machine instances are used to test multiple software versions, then detection coverage is improved, but resource utilization deteriorates

Engineering Contradiction:

Improvedetection coverageVSAvoidvirtual machine resources

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent combines multiple virtual machine environments into a single integrated system. Multiple software versions are installed within one virtual machine, and a single malware instance is tested against all versions simultaneously, eliminating the need for multiple separate virtual machine instances while maintaining comprehensive detection coverage

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The virtual machine is designed to perform multiple functions by hosting different software versions concurrently. A single virtual machine instance serves as a universal testing platform that can evaluate malware against multiple software versions without requiring separate dedicated environments for each version

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Reliability

If multiple virtual machine instances are used to test multiple software versions, then detection accuracy is improved, but testing time increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidtesting time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system enables continuous malware testing across multiple software versions within a single virtual machine environment. By having all software versions pre-installed and ready, the malware can be tested against each version sequentially without the time-consuming process of launching, configuring, and terminating multiple separate virtual machine instances

Inventive Principle:

Principle #20Continuity of useful action

Solution Approach 2:

Multiple software versions are pre-installed and configured within the virtual machine before malware testing begins. This preliminary preparation eliminates the need to set up each testing environment from scratch during the actual malware analysis process, significantly reducing total testing time

Inventive Principle:

Principle #10Preliminary action

3Quantity of substance

If a single virtual machine is used to test multiple software versions, then resource utilization is improved, but the ability to detect polymorphic malware deteriorates

Engineering Contradiction:

Improvevirtual machine resourcesVSAvoidpolymorphic malware detection

Core Design Contradiction:

Quantity of substanceVSReliability

Solution Approach 1:

The system dynamically switches between different software version configurations within the single virtual machine during malware testing. The virtual machine can adaptively load and execute different software versions based on the specific malware being analyzed, allowing comprehensive detection of polymorphic malware that targets specific version vulnerabilities while maintaining efficient resource utilization

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11210390B1Multi-version application support and registration within a single operating system environment

Publication Date: 2021.12.28 MAGENTA SECURITY HOLDINGS LLC

AI summary

Techniques for efficient malicious content detection in plural versions of a software application are described. According to one embodiment, the computerized method includes installing a plurality of different versions of a software application concurrently within a virtual machine and selecting a subset of the plurality of versions of the software application that are concurrently installed within the virtual machine. Next, one or more software application versions of the subset of the plurality of versions of the software application are processed to access a potentially malicious content suspect within the virtual machine, without switching to another virtual machine. The behaviors of the potentially malicious content suspect during processing by the one or more software application versions are monitored to detect behaviors associated with a malicious attack. Thereafter, information associated with the detected behaviors pertaining to a malicious attack is stored, and an alert with respect to the malicious attack is issued.