Efficient detection of stealthy malware attacks in suspicious files is very challenging as dynamic malware analysis is time consuming. This paper proposes a virtual time control mechanics-based method to overcome the challenge. The proposed method utilizes a modified Xen hypervisor, in which a virtual clock source is generated according to a predefined speed ratio, such that sandbox systems running on the modified hypervisor can be accelerated. Thus, it does not modify operating system kernels nor intercept system function calls, and is therefore compatible with various operating systems. Further, it utilizes an entropy-based measure that adjusts its execution time according to various malware inputs as an early termination criterion. The results of experiments conducted to verify the efficacy of the proposed method indicate that it speeds up the system timer and significantly increases the logged record size by up to 42% or obtains the same log size within a shorter period compared with conventional sandboxes. Thus, the proposed virtual time control mechanics-based method efficiently detects nontrivial anomalous codes that may be neglected by conventional sandboxing techniques.
Computers & Security – Elsevier
Published: Mar 1, 2018
It’s your single place to instantly
discover and read the research
that matters to you.
Enjoy affordable access to
over 18 million articles from more than
15,000 peer-reviewed journals.
All for just $49/month
Query the DeepDyve database, plus search all of PubMed and Google Scholar seamlessly
Save any article or search result from DeepDyve, PubMed, and Google Scholar... all in one place.
Get unlimited, online access to over 18 million full-text articles from more than 15,000 scientific journals.
Read from thousands of the leading scholarly journals from SpringerNature, Elsevier, Wiley-Blackwell, Oxford University Press and more.
All the latest content is available, no embargo periods.
“Hi guys, I cannot tell you how much I love this resource. Incredible. I really believe you've hit the nail on the head with this site in regards to solving the research-purchase issue.”Daniel C.
“Whoa! It’s like Spotify but for academic articles.”@Phil_Robichaud
“I must say, @deepdyve is a fabulous solution to the independent researcher's problem of #access to #information.”@deepthiw
“My last article couldn't be possible without the platform @deepdyve that makes journal papers cheaper.”@JoseServera