MALWARE DETECTION USING SANDBOX ANALYSIS

Behavior-Based Detection Behavior-based detection focuses on monitoring system activities to identify maliciousbehavior. This approach is effective against unknown malware, as it does not relyonpredefined signatures. However, it can generate false positives due to its reliance on heuristicrules (Smallman, 2024) (Aslan & Samet, 2020). Examples are sandboxing and heuristicanalysis (identifying malware by analyzing code structures or behaviors that resemble knownmalicious patterns (Stamp, 2021)).  Hybrid Approaches Hybrid approaches combine signature-based and behavior-based detection to leveragethestrengths of both methods. These approaches are more robust than single-method techniquesbut require significant computational resources (Ғиесова…, 2023) (Talukder, 2020). Examples are Next-Generation Antivirus (NGAV) and Endpoint Detection &Response(EDR). 2.2. Malware Analysis Malware analysis is the process of examining and understanding how malicious softwareoperates, its functionality, and its impact on a system. This process helps cybersecurityprofessionals identify the malware’s origin, behavior, infection methods, and potential vulnerabilities it exploits. Malware analysis is typically performed using three maintechniques: static analysis, dynamic analysis and hybrid analysis. The insights gainedfrommalware analysis are used to develop better detection methods, strengthen systemdefenses, and create effective countermeasures against future threats.