Detecting malware by pooled analysis of sample files in a sandbox
AssigneeTrend Micro Incorporated
InventorsJun Qu, Zhichao Ding, Renkui Tao
Life of this patent
Estimating the term…
Abstract
Systems and methods are presented for performing sandboxing to detect malware. Sample files are received and activated individually in separate sandboxes in one mode of operation. In another mode of operation, sample files are assigned to pools. Sample files of a pool are activated together in the same sandbox. The sample files of the pool are deemed to be normal when no anomalous event is detected in the sandbox. Otherwise, when an anomalous event is detected in the sandbox, the sample files of the pool are activated separately in separate sandboxes to isolate and identify malware among the sample files.
Claims10
A method of detecting malware by sandboxing, the method comprising:
- assigning a plurality of sample files to a plurality of pools;
- executing a first set of sample files assigned to a first pool of the plurality of pools together in a first sandbox;
- in response to detecting an anomalous event in the first sandbox during said execution of the first set of sample files, executing each of the first set of sample files individually in separate sandboxes such that each of the first set of sample files is executed in one of the separate sandboxes;
- and
- in response to detecting an anomalous event in a second sandbox from among the separate sandboxes where a particular sample file of the first set of sample files is executed individually and separate from other sample files of the first set of sample files, detecting the particular sample file to be malware.
A computer comprising a memory and a processor, the memory storing instructions that when executed by the processor cause the computer to:
- assign a plurality of sample files to a plurality of pools;
- execute a first set of sample files assigned to a first pool of the plurality of pools together in a first sandbox;
- in response to detecting an anomalous event in the first sandbox during said execution of the first set of sample files, execute each of the first set of sample files individually in separate sandboxes to identify which of the first set of sample files is malware such that each of the first set of sample files is executed in one of the separate sandboxes;
- and
- in response to detecting an anomalous event in a second sandbox from among the separate sandboxes where a particular sample file of the first set of sample files is executed individually and separate from other sample files of the first set of sample files, detect that the particular sample file is malware.
A method of detecting malware by sandboxing, the method comprising:
- receiving a first set of sample files assigned to a first pool;
- in a first mode of operation, executing each of the first set of sample files individually and separately in different sandboxes to evaluate the first set of sample files for malware;
- receiving a second set of sample files;
- in a second mode of operation:
- assigning the second set of sample files to a second pool;
- executing the second set of sample files together in a first sandbox;
- in response to detecting an anomalous event in the first sandbox during said execution of the second set of sample files, executing each of the second set of sample files individually in separate sandboxes to detect malware in the second set of sample files such that each of the second set of sample files is executed in one of the separate sandboxes;
- and
- in response to detecting an anomalous event in a second sandbox from among the separate sandboxes where a particular sample file of the second set of sample files is executed individually and separate from other sample files of the second set of sample files, detecting that the particular sample file is malware.
Dependencies are inferred from the claim text.