Catching malware by combining static and behavioral analysis

Traditional antivirus tools rely heavily on static signatures: they recognise a malware because they have already seen it. The issue is well known — a slightly modified binary can slip through.

The approach here combines two layers of analysis: a static analysis, via Sigma rules, and a behavioral (dynamic) analysis that watches what a binary actually does once executed. System calls, memory access, network activity: behavior betrays intent where a signature alone can be evaded.

To observe safely, each binary runs inside an isolated, disposable Firecracker micro-VM. eBPF monitoring captures kernel events at minimal cost, and a Bayesian score aggregates the static and behavioral signals into a probability of maliciousness, backed by 207 Sigma rules.

Result on the test corpus: 90.7% detection and 0% false positives, where ClamAV tops out at 55.8%. The natural next step: broaden the corpus and harden the VM orchestration.

This deep-dive will be expanded soon. In the meantime, feel free to reach out to discuss it.