Using Hyper-V Sockets for Real-time Data Extraction from a Malware Analysis Sandbox
2026-08-31 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors explain how Hyper-V sockets can be used to allow a malware analysis sandbox to communicate quickly and secretly in real-time. They found that Hyper-V sockets avoid common network blocks and don't show up in usual tools that list network connections, unlike typical WinSock TCP sockets. They also compared how fast both types are when different amounts of data are sent. This suggests Hyper-V sockets might be a better way for secure, hidden communication in certain cybersecurity setups.
Hyper-V socketsmalware analysis sandboxWinSock TCP socketsTCP/IP blockingthroughputreal-time communicationTCP connection enumerationbuffer size
Authors
István-Attila Császár, Radu-Marian Portase, Adrian Coleşa, Adrian Groza
Abstract
We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox. We show that, compared to WinSock TCP sockets, Hyper-V sockets are not subject to TCP/IP-layer blocking and are not enumerated by common TCP connection listing tools. We compare the throughput of the two communication channels as a function of buffer size.