Using Hyper-V Sockets for Real-time Data Extraction from a Malware Analysis Sandbox

arXiv:2608.30383 · cs.CR · Submitted 2026-08-31 · Read on arXiv

cs.CR

Submitted: 2026-08-31

Updated: 2026-08-31

Journal ref: 2026 IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR)

DOI: 10.1109/AQTR70159.2026.11577802

Code: https://github.com/huntandhackett/AfdSocketViewer

License: http://creativecommons.org/licenses/by-nc-sa/4.0/

The gist: We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox.

Terminology

Trace — 11× in this paper · explained in 2 episodes
Windows Filtering Platform — 4× in this paper
Introspection — 2× in this paper · explained in 2 episodes
Antimalware Protected Process Light — 1× in this paper
Benchmark — 1× in this paper · explained in 2 episodes
Fidelity — 1× in this paper · explained in 2 episodes
Network Store Interface — 1× in this paper
Semantic Gap — 1× in this paper · explained in 2 episodes

Abstract

We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox. We show that, compared to WinSock TCP sockets, Hyper-V sockets are not subject to TCP/IP-layer blocking and are not enumerated by common TCP connection listing tools. We compare the throughput of the two communication channels as a function of buffer size.

Terminology

Abstract

Related papers