paper

Using Hyper-V Sockets for Real-time Data Extraction from a Malware Analysis Sandbox

arXiv:2608.30383 · doi:10.1109/AQTR70159.2026.11577802

Abstract

We present how Hyper-V sockets can be used as a real-time communication channel for a malware analysis sandbox. We show that, compared to WinSock TCP sockets, Hyper-V sockets are not subject to TCP/IP-layer blocking and are not enumerated by common TCP connection listing tools. We compare the throughput of the two communication channels as a function of buffer size.

Using Hyper-V Sockets for Real-time Data Extraction from a Malware Analysis Sandbox · wovepaper