Malicious content analysis with multi-version application support within single operating environment

A non-transitory machine-readable medium storing instructions, which when executed by a processor, cause the processor to perform operations comprising:

• installing a plurality of versions of a software application concurrently within a virtual machine by at least registering each of the plurality of versions of the software application with an operating system of the virtual machine under different identifiers, each of the plurality of versions of the software application being different from each other;
• selecting, by logic within a virtual machine monitor operating on a processor of a data processing system, a subset of the plurality of versions of the software application that are concurrently installed within the virtual machine that is executed within the data processing system;
• for one or more software application versions of the subset of the plurality of versions of the software application, processing the corresponding software application version to access a malicious content suspect within the virtual machine without switching to another virtual machine;
• monitoring behaviors of the malicious content suspect during execution by the one or more software application versions of the subset of the plurality of versions of the software application to detect behaviors associated with a malicious attack during execution of any of the one or more software application versions;
• storing information associated with the detected behaviors that are associated with a malicious attack;
• and
• issuing an alert with respect to any indicated malicious content, the alert comprises an identifier of the software application version with the detected behaviors.

A malicious content detection system, comprising:

• a processor;
• and
• a memory coupled to the processor, the memory to store instructions, including instructions that, when executed, cause the processor to
• install a plurality of versions of a software application concurrently within a virtual machine by at least registering each of the plurality of versions of the software application with an operating system of the virtual machine under different identifiers, each of the plurality of versions of the software application being different from each other,
• select, by logic within a virtual machine monitor, a subset of the plurality of versions of the software application that are concurrently installed within a virtual machine that is executed within the malicious content detection system,
• process one or more software application versions of the subset of the plurality of versions of the software application to access a malicious content suspect within the virtual machine, without switching to another virtual machine,
• monitor behaviors of the malicious content suspect during processing by each software application version of the subset of the plurality of versions of the software application in response to the malicious content suspect to detect a behavior associated with a malicious attack,
• store information associated with the detected behavior associated with a malicious attack, and
• issue an alert with respect to any detected malicious content.