An Infrastructure for Detecting Malware

A malware is a program that has a malicious intent. Nowadays, attack from malwares is rising in alarming fashion and thousands of malwares are injected to the Internet. Malware authors use many techniques like obfuscation and packing to avoid detection. A number of techniques for malware detection are available and none of them able to detect all types of malwares. In this paper, a more efficient malware detection framework is presented. This framework utilizes the ability of sandbox to analyze files in an isolated environment. A group of sandbox is arranged parallel and process each incoming file from the Internet to internal network. A credit is assigned to each operation made by the file under inspection. Report generated by each sandbox is converted into a general intermediate format. Average credit of a specific file is calculated based on average credit from individual reports. Files are classified as malicious or benign based on this final average credit. This system increases the efficiency of malware detection by using multiple dynamic analysis technics. General Terms Security, malware detection, malware analysis, sandbox, advanced persistent threat.