Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper explores the use of Hyper-V sockets as a communication channel for malware analysis sandboxes, highlighting their advantages over traditional WinSock TCP sockets. The authors demonstrate that Hyper-V sockets avoid TCP/IP-layer blocking and remain undetected by standard TCP connection listing tools, enhancing the stealth and efficiency of malware analysis. Through empirical evaluation, they compare the throughput of both socket types, revealing significant performance benefits with Hyper-V sockets at varying buffer sizes.
Hyper-V sockets can significantly enhance the stealth and throughput of malware analysis, bypassing common detection methods used by adversaries.
We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox. We show that, compared to WinSock TCP sockets, Hyper-V sockets are not subject to TCP/IP-layer blocking and are not enumerated by common TCP connection listing tools. We compare the throughput of the two communication channels as a function of buffer size.