Build a Better Sandbox: a working strategy for comprehensive malware protection

One of the most promising developments in network security is the area of dynamic analysis detection, commonly known as sandboxing. A number of products are currently available and others are in various stages of commercialization. Not surprisingly, the architectural approaches taken by leading developers vary widely, as do the ways these new products fit into larger security strategies. This paper proposes a logical design strategy for dynamic malware analysis that optimizes detection effectiveness, efficiency, and economics.