A Method for Malware Detection in Virtualization Environment

Abstract

Security of Virtual Machines (VMs) is a major concern with the virtualization environment. Virtual machines are a primary target for an adversary to acquire unethical access to the organization’s virtual infrastructure. Traditional security measures are not enough for advanced malware detection. Today’s advanced malware can easily avoid detection by using a number of evasion tactics. Process or code injection is one such technique to evade the detection of malware. Various process injection techniques are employed by malware to gain more stealth and to bypass security products. Detection of process injection attack is achieved with little effort on a physical machine as compared to a virtual machine. In this paper, we propose a novel approach to detect malware based on API function calls. API function call information has the ability to trace malware behavior. We found that the presence of certain API function calls may confirm the existence of malware. We implement dynamic malware analysis using the volatility framework.