Dynamic malware analysis of a URL using a browser executed in an instrumented virtual machine environment

摘要

Various techniques for performing malware analysis of a URL (e.g., a URL sample) using a browser executed in an instrumented virtual machine environment are disclosed. In some embodiments, a system for performing dynamic malware analysis of a URL using a browser executed in an instrumented virtual machine environment includes the instrumented virtual machine environment executed on a processor that receives a URL sample for dynamic malware analysis using the browser executed in the instrumented virtual machine environment; and a dynamic time allocator executed on the processor that dynamically determines a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, in which the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample.

主权项

1. A system for performing dynamic malware analysis of Uniform Resource Locator (URL) samples using a browser executed in an instrumented virtual machine environment, comprising:
the instrumented virtual machine environment executed on a processor that receives a URL sample for dynamic malware analysis using the browser executed in the instrumented virtual machine environment; and a dynamic time allocator executed on the processor that dynamically determines a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample, wherein the determining of the period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment comprises:
reducing a time-out delay of the URL sample to be shorter;modifying a refresh delay of the URL sample to be shorter; andtriggering execution of content of the URL sample.