You can record the contents of the disk before you run the malware and after, and then do a diff. You can also sniff network traffic.

I'm not sure how long you'd want to wait to give it a green light, if it doesn't do anything obviously bad, though. Maybe this could be combined with forwarding the clock to trick the malware in to thinking a lot of time has passed?

Diffing the disk won't do you much good, the malware does it's interesting things in memory. Overall as I said this doesn't scale.

Viruses can spread copies of themselves and infect other programs, and can leave trails on the disk. They can also infect the mbr. Then there's ransomware which encryptes files on disk. These are all examples of malware that could be detected by diffing the disk. Of course, if it doesn't touch the disk, then you're left with network traces.

I'm not saying they don't it just not the most interesting thing you may want to look at ;) Anyhow don't bother with even trying to use physical machines as your primary platform, VM or better instruction level emulation is the way to go, not foolproof but it is at least scalable and flexible enough.

You also seem to conflict what detection means, detection can be easy "is this a known binary" if not > malware can be a pretty easy (if unrealistic) classification, when researchers talk about detecting malware we are talking about understanding what it does.

Diffing disks isn't really going to get you far.

I can assure you, usb or pci DMA debuggers exist. You raise an interrupt and dump all memory with it.