Methods and systems for maintaining a sandbox for use in malware detection

A system for detecting or preventing malware execution, the system comprising:

• computer memory storing a virtual machine replicating a target computing system;
• one or more hypervisors configured to execute the virtual machine;
• and
• one or more computing processors configured to:
• maintain the virtual machine replicating the target computing system by:
• capturing a hibernation state of the target computing system,
• monitoring the target computing system for a plurality of possible events, the plurality of possible events including change events and risk events,
• detecting a change event on the target computing system and blocking the target computing system from performing the detected change event until updating the virtual machine, the detected change event comprising an approved or intentional modification to the target computing system,
• transitioning the virtual machine from an inactive state, corresponding to the captured hibernation state, to an active state,
• update the virtual machine by applying the detected change event to the virtual machine in the active state,
• transitioning the updated virtual machine from the active state to the inactive state subsequent to executing the change event, and
• preserving the virtual machine updated with the detected change event;
• detect a risk event on the target computing system;
• cause at least one of the one or more hypervisors to execute the risk event on the preserved virtual machine updated with the detected change event;
• and
• determine that the risk event is malicious based on observation of execution of the risk event on the virtual machine.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

• maintain a virtual machine replicating a target computing system by:
• capturing a hibernation state of the target computing system,
• monitoring the target computing system for a plurality of possible events, the plurality of possible events including change events and risk events,
• detecting a change event on the target computing system and blocking the target computing system from performing the detected change event until updating the virtual machine, the detected change event comprising an approved or intentional modification to the target computing system,
• transitioning the virtual machine from an inactive state, corresponding to the captured hibernation state, to an active state,
• updating the virtual machine by applying the detected change event to the virtual machine in the active state,
• transitioning the updated virtual machine from the active state to the inactive state subsequent to executing the change event, and
• preserving the virtual machine updated with the detected change event;
• detect a risk event on the target computing system;
• execute the risk event on the preserved virtual machine updated with the detected change event;
• and
• determine that the risk event is malicious based on observation of execution of the risk event on the virtual machine.