arXiv ScienceSearch

arXiv · 2608.30383

Using Hyper-V Sockets for Real-time Data Extraction from a Malware Analysis Sandbox

Abstract

We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox. We show that, compared to WinSock TCP sockets, Hyper-V sockets are not subject to TCP/IP-layer blocking and are not enumerated by common TCP connection listing tools. We compare the throughput of the two communication channels as a function of buffer size.

Explore related subjects

Keep this discovery

BibTeXRIS

István-Attila Császár, Radu-Marian Portase, Adrian Coleşa, Adrian Groza. 2026-08-31. Using Hyper-V Sockets for Real-time Data Extraction from a Malware Analysis Sandbox. https://doi.org/10.1109/aqtr70159.2026.11577802

Cite the original work for its findings. Save a collection to share your selection of sources.

Discover connections

Connections use source metadata and explicit phrase matches, not verified experimental comparisons.

KEEP EXPLORING

Related papers

The Impact of Magma: A Ground-Truth Fuzzing Benchmark

Magma is an open-source and ground-truth fuzzing benchmark that enables uniform fuzzer evaluation and comparison. Magma was originally released with a research paper published at ACM SIGMETRICS 2021. This short paper explains the motivation, the design, and the impact of Magma, with a description of extensions to the original benchmark.

cs.CR

Permutation polynomials over finite fields from low-degree rational functions

This paper considers permutation polynomials over the finite field $F_{q^2}$ in even characteristic by utilizing low-degree permutation rational functions over $F_q$. As a result, we obtain two classes of permutation binomials and six classes of permutation pentanomials over $F_{q^2}$. Additionally, we show that the obtained binomials and pentanomials are quasi-multiplicative inequivalent to the known ones in the literature.

cs.CR

The Five Safes as a Privacy Context

The Five Safes is a framework used by national statistical offices (NSO) for assessing and managing the disclosure risk of data sharing. It can be understood as a specialization of a broader concept--contextual integrity--to the situation of statistical dissemination by an NSO. We demonstrate this by mapping the five parameters of contextual integrity onto the five dimensions of the Five Safes. We also discuss how each of these two theories can address weaknesses in the other, thereby strengthening them both.

cs.CR