Hypervisor-assisted dynamic malware analysis

Roee S. Leon, Michael Kiperberg, Anat Anatey Leon Zabag, Nezer Jacob Zaidenberg

Research output: Contribution to journalArticlepeer-review

Abstract

Malware analysis is a task of utmost importance in cyber-security. Two approaches exist for malware analysis: static and dynamic. Modern malware uses an abundance of techniques to evade both dynamic and static analysis tools. Current dynamic analysis solutions either make modifications to the running malware or use a higher privilege component that does the actual analysis. The former can be easily detected by sophisticated malware while the latter often induces a significant performance overhead. We propose a method that performs malware analysis within the context of the OS itself. Furthermore, the analysis component is camouflaged by a hypervisor, which makes it completely transparent to the running OS and its applications. The evaluation of the system’s efficiency suggests that the induced performance overhead is negligible.

Original languageEnglish
Article number19
JournalCybersecurity
Volume4
Issue number1
DOIs
StatePublished - Dec 2021
Externally publishedYes

All Science Journal Classification (ASJC) codes

  • Software
  • Information Systems
  • Computer Networks and Communications
  • Artificial Intelligence

Fingerprint

Dive into the research topics of 'Hypervisor-assisted dynamic malware analysis'. Together they form a unique fingerprint.

Cite this