Tien, C.-W.C.-W.TienLiao, J.-W.J.-W.LiaoChang, S.-C.S.-C.ChangSY-YEN KUO2020-06-112020-06-112017https://scholars.lib.ntu.edu.tw/handle/123456789/500901A security sandbox is a technology that is often used to detect advanced malware. However, current sandboxes are highly dependent on VM hypervisor types and versions. Thus, in this paper, we introduce a new sandbox design, using memory forensics techniques, to provide an agentless sandbox solution that is independent of the VM hypervisor. In particular, we leverage the VM introspection method to monitor malware running memory data outside the VM and analyze its system behaviors, such as process, file, registry, and network activities. We evaluate the feasibility of this method using 20 advanced and 8 script-based malware samples. We furthermore demonstrate how to analyze malware behavior from memory and verify the results with three different sandbox types. The results show that we can analyze suspicious malware activities, which is also helpful for cyber security defense. © 2017 IEEE.Advanced malware analysis; Cyber security; Security sandbox; Virtual machine introspection[SDGs]SDG16Computer crime; Network security; Virtual machine; Cyber security; ITS systems; Malware analysis; Malware behaviors; Memory forensics; Network activities; Security sandbox; Virtual machine introspection; Malwareconference paper10.1109/DESEC.2017.80738712-s2.0-85039918226https://www.scopus.com/inward/record.uri?eid=2-s2.0-85039918226&doi=10.1109%2fDESEC.2017.8073871&partnerID=40&md5=1564aef51191a69818ba098fc4773923