Zero-Day Detection via Segmented Virtual Machine Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security appliances are ineffective in detecting zero-day attacks, which exploit previously unknown vulnerabilities, leading to delayed warnings for zero-day threats.
Innovation Solution
A system utilizing virtual machines (VMs) based on software profiles, with one set configured for fortified software to detect known exploits and another set for vulnerable software to identify zero-day attacks by simulating execution of suspicious content and analyzing potential exploits within VM environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security appliances are used to detect malware, then known malware threats can be detected, but zero-day attacks cannot be detected
Solution Approach 1:
The system segments the detection function into two distinct virtual machine environments: one configured with fortified software to detect known exploits, and another configured with vulnerable software to detect zero-day attacks. This segmentation allows each environment to specialize in detecting specific types of threats without interfering with the other.
Solution Approach 2:
The system creates copies of software environments in virtual machine form, allowing the same software to be instantiated in both vulnerable and fortified states. This copying enables parallel testing of exploits against both patched and unpatched versions, facilitating the detection of zero-day vulnerabilities.
2Measurement precision
If virtual machines with fortified software are used to detect exploits, then known vulnerabilities can be identified, but zero-day attacks cannot be detected
Solution Approach 1:
The detection system is segmented into two specialized virtual machine environments: one with fortified software for detecting known exploits, and another with vulnerable software for detecting zero-day attacks. This segmentation ensures that each environment is optimized for its specific detection task.
Solution Approach 2:
Instead of using only patched software to detect exploits, the system inverts the approach by also deploying vulnerable software versions that can be executed by zero-day exploits. This inversion enables the detection of previously unknown vulnerabilities while maintaining the ability to detect known exploits.
3Adaptability or versatility
If multiple virtual machine environments are deployed for comprehensive threat detection, then both known and unknown threats can be detected, but system complexity increases
Solution Approach 1:
A controller acts as an intermediary component that manages the two virtual machine environments, coordinates threat detection operations, and processes results. This intermediary simplifies the overall system architecture by providing centralized control and coordination between the fortified and vulnerable software environments.
Solution Approach 2:
The virtual machine framework provides a universal platform that can host both fortified and vulnerable software environments, allowing a single system architecture to perform multiple detection functions. This multi-functionality reduces the need for separate dedicated systems for different detection tasks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for determining a zero-day attack by an electronic device is described. According to one embodiment, the method comprises instantiating, by the electronic device, at least one virtual machine, the at least one virtual machine being based on a fortified software profile. The method further comprises executing content capable of behaving as an exploit on the at least one virtual machine, and determining that the exploit is associated with zero-day exploit when the exploit, upon execution of the content on the at least one virtual machine, performs an undesired behavior.