Hypervisor-assisted dynamic malware analysis

• 作者: Roee S.Leon Michael Kiperberg Anat Anatey Leon Zabag Nezer Jacob Zaidenberg
• 来源期刊: 网络空间安全科学与技术（英文版）
• 年，卷（期）: 2021,（3）
• 页码范围: 31-44
• 页数: 14页
• 语种: 英文

摘要

Malware analysis is a task of utmost importance in cyber-security.Two approaches exist for malware analysis:static and dynamic.Modern malware uses an abundance of techniques to evade both dynamic and static analysis tools.Current dynamic analysis solutions either make modifications to the running malware or use a higher privilege component that does the actual analysis.The former can be easily detected by sophisticated malware while the latter often induces a significant performance overhead.We propose a method that performs malware analysis within the context of the OS itself.Furthermore,the analysis component is camouflaged by a hypervisor,which makes it completely transparent to the running OS and its applications.The evaluation of the system's efficiency suggests that the induced performance overhead is negligible.