Work

Using Hyper-V Sockets for Real-Time Data Extraction From a Malware Analysis Sandbox

Year: 2026

Type: conference-paper

Abstract: We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox. We show that, compared to WinSock TCP sockets, Hyper-V sockets are not subject to TCP/IP-layer blocking and are not enumerated by common TCP connection listing tools. We compare the throughput of the two communication channels as a function of buffer size.

Source: IEEE International Conference on Automation, Quality and Testing, Robotics (AQTR)

DOI: 10.1109/aqtr70159.2026.11577802

Authors: Istvan-Attila Császár, Radu-Marian Portase, Adrian Coleşa, Adrian Groza

Institution: Technical University of Cluj-Napoca

Topic: Advanced Malware Detection Techniques

Subfield: Signal Processing

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

OpenAlex ID: W7166831356

FWCI:

Cites: 2

Cited by:

Related to: