The Experts below are selected from a list of 13815 Experts worldwide ranked by ideXlab platform
Christopher Kruegel - One of the best experts on this subject based on the ideXlab platform.
-
hulk eliciting Malicious Behavior in browser extensions
USENIX Security Symposium, 2014Co-Authors: Alexandros Kapravelos, Christopher Kruegel, Giovanni Vigna, Chris Grier, Neha Chachra, Vern PaxsonAbstract:We present Hulk, a dynamic analysis system that detects Malicious Behavior in browser extensions by monitoring their execution and corresponding network activity. Hulk elicits Malicious Behavior in extensions in two ways. First, Hulk leverages HoneyPages, which are dynamic pages that adapt to an extension's expectations in web page structure and content. Second, Hulk employs a fuzzer to drive the numerous event handlers that modern extensions heavily rely upon. We analyzed 48K extensions from the Chrome Web store, driving each with over 1M URLs. We identify a number of Malicious extensions, including one with 5.5 million affected users, stressing the risks that extensions pose for today's web security ecosystem, and the need to further strengthen browser security to protect user data and privacy.
-
a survey on automated dynamic malware analysis techniques and tools
ACM Computing Surveys, 2012Co-Authors: Manuel Egele, Engin Kirda, Theodoor Scholte, Christopher KruegelAbstract:Anti-virus vendors are confronted with a multitude of potentially Malicious samples today. Receiving thousands of new samples every day is not uncommon. The signatures that detect confirmed Malicious threats are mainly still created manually, so it is important to discriminate between samples that pose a new unknown threat and those that are mere variants of known malware. This survey article provides an overview of techniques based on dynamic analysis that are used to analyze potentially Malicious samples. It also covers analysis programs that leverage these It also covers analysis programs that employ these techniques to assist human analysts in assessing, in a timely and appropriate manner, whether a given sample deserves closer manual inspection due to its unknown Malicious Behavior.
-
barebox efficient malware analysis on bare metal
Annual Computer Security Applications Conference, 2011Co-Authors: Dhilung Kirat, Giovanni Vigna, Christopher KruegelAbstract:Present-day malware analysis techniques use both virtualized and emulated environments to analyze malware. The reason is that such environments provide isolation and system restoring capabilities, which facilitate automated analysis of malware samples. However, there exists a class of malware, called VM-aware malware, which is capable of detecting such environments and then hide its Malicious Behavior to foil the analysis. Because of the artifacts introduced by virtualization or emulation layers, it has always been and will always be possible for malware to detect virtual environments. The definitive way to observe the actual Behavior of VM-aware malware is to execute them in a system running on real hardware, which is called a "bare-metal" system. However, after each analysis, the system must be restored back to the previous clean state. This is because running a malware program can leave the system in an instable/insecure state and/or interfere with the results of a subsequent analysis run. Most of the available state-of-the-art system restore solutions are based on disk restoring and require a system reboot. This results in a significant downtime between each analysis. Because of this limitation, efficient automation of malware analysis in bare-metal systems has been a challenge. This paper presents the design, implementation, and evaluation of a malware analysis framework for bare-metal systems that is based on a fast and rebootless system restore technique. Live system restore is accomplished by restoring the entire physical memory of the analysis operating system from another, small operating system that runs outside of the target OS. By using this technique, we were able to perform a rebootless restore of a live Windows system, running on commodity hardware, within four seconds. We also analyzed 42 malware samples from seven different malware families, that are known to be "silent" in a virtualized or emulated environments, and all of them showed their true Malicious Behavior within our bare-metal analysis environment.
-
the power of procrastination detection and mitigation of execution stalling Malicious code
Computer and Communications Security, 2011Co-Authors: Clemens Kolbitsch, Engin Kirda, Christopher KruegelAbstract:Malware continues to remain one of the most important security problems on the Internet today. Whenever an anti-malware solution becomes popular, malware authors typically react promptly and modify their programs to evade defense mechanisms. For example, recently, malware authors have increasingly started to create Malicious code that can evade dynamic analysis. One recent form of evasion against dynamic analysis systems is stalling code. Stalling code is typically executed before any Malicious Behavior. The attacker's aim is to delay the execution of the Malicious activity long enough so that an automated dynamic analysis system fails to extract the interesting Malicious Behavior. This paper presents the first approach to detect and mitigate Malicious stalling code, and to ensure forward progress within the amount of time allocated for the analysis of a sample. Experimental results show that our system, called HASTEN, works well in practice, and that it is able to detect additional Malicious Behavior in real-world malware samples.
-
mining specifications of Malicious Behavior
Foundations of Software Engineering, 2007Co-Authors: Mihai Christodorescu, Somesh Jha, Christopher KruegelAbstract:Malware detectors require a specification of Malicious Behavior. Typically, these specifications are manually constructed by investigating known malware. We present an automatic technique to overcome this laborious manual process. Our technique derives such a specification by comparing the execution Behavior of a known malware against the execution Behaviors of a set of benign programs. In other words, we mine the Malicious Behavior present in a known malware that is not present in a set of benign programs. The output of our algorithm can be used by malware detectors to detect malware variants. Since our algorithm provides a succinct description of Malicious Behavior present in a malware, it can also be used by security analysts for understanding the malware. We have implemented a prototype based on our algorithm and tested it on several malware programs. Experimental results obtained from our prototype indicate that our algorithm is effective in extracting Malicious Behaviors that can be used to detect malware variants.
Kai Chen - One of the best experts on this subject based on the ideXlab platform.
-
mbtree detecting encryption rats communication using Malicious Behavior tree
IEEE Transactions on Information Forensics and Security, 2021Co-Authors: Cong Dong, Zelin Cui, Baoxu Liu, Kai ChenAbstract:Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT) . Compared to statistical-based detection of Malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree , an approach to detect encryption RATs Command and Control (C&C) communication based on host-level network trace Behavior. MBTree first models the RAT network Behaviors as the Malicious set by automatically building the multiple level tree, MLTree from distinctive network traces of each sample. Then, MBTree employs a detection algorithm to detect Malicious network traces that are similar to any MLTrees in the Malicious set. To illustrate the effectiveness of our proposed method, we adopt theoretical analysis of MBTree from the probability perspective. In addition, we have implemented MBTree to evaluate it on five datasets which are reorganized in a sophisticated manner for comprehensive assessment. The experimental results demonstrate the accurate and robust of MBTree, especially in the face of new emerging benign applications.
Cong Dong - One of the best experts on this subject based on the ideXlab platform.
-
mbtree detecting encryption rats communication using Malicious Behavior tree
IEEE Transactions on Information Forensics and Security, 2021Co-Authors: Cong Dong, Zelin Cui, Baoxu Liu, Kai ChenAbstract:Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT) . Compared to statistical-based detection of Malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree , an approach to detect encryption RATs Command and Control (C&C) communication based on host-level network trace Behavior. MBTree first models the RAT network Behaviors as the Malicious set by automatically building the multiple level tree, MLTree from distinctive network traces of each sample. Then, MBTree employs a detection algorithm to detect Malicious network traces that are similar to any MLTrees in the Malicious set. To illustrate the effectiveness of our proposed method, we adopt theoretical analysis of MBTree from the probability perspective. In addition, we have implemented MBTree to evaluate it on five datasets which are reorganized in a sophisticated manner for comprehensive assessment. The experimental results demonstrate the accurate and robust of MBTree, especially in the face of new emerging benign applications.
Satoshi Nakamura - One of the best experts on this subject based on the ideXlab platform.
-
a visual analytics tool for system logs adopting variable recommendation and feature based filtering
2013 17th International Conference on Information Visualisation, 2013Co-Authors: Aki Hayashi, Takayuki Itoh, Satoshi NakamuraAbstract:Analysis and monitoring of system logs such as transaction logs and access logs is important for various objectives including trend discovery, update effort determination, and Malicious Behavior monitoring. However, it is not always an easy task because these logs may be massive, consisting of millions of records containing tens of variables, and therefore it may be difficult or time-consuming to discover significant knowledge. This paper presents a visual analytics tool which enables us to effectively observe system logs. The tool recommends variables that can reveal interesting discoveries and provides feature-based filtering that selects meaningful items from the visualization results. This paper also presents the result of experiments for non-professional users.
-
a visual analytics tool for system logs adopting variable recommendation and feature based filtering
ACM Symposium on Applied Computing, 2013Co-Authors: Aki Hayashi, Takayuki Itoh, Satoshi NakamuraAbstract:Analysis and monitoring of system logs such as transaction logs and access logs is important for various objectives including trend discovery, update effort determination, and Malicious Behavior monitoring. However, it is not always an easy task because these logs may be massive, consisting of millions of records containing tens of variables, and therefore it may be difficult or time-consuming to discover significant knowledge. This paper presents a visual analytics tool which enables us to effectively observe system logs. The tool recommends variables that can reveal interesting discoveries and provides feature-based filtering that selects meaningful items from the visualization results.
Zelin Cui - One of the best experts on this subject based on the ideXlab platform.
-
mbtree detecting encryption rats communication using Malicious Behavior tree
IEEE Transactions on Information Forensics and Security, 2021Co-Authors: Cong Dong, Zelin Cui, Baoxu Liu, Kai ChenAbstract:Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT) . Compared to statistical-based detection of Malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree , an approach to detect encryption RATs Command and Control (C&C) communication based on host-level network trace Behavior. MBTree first models the RAT network Behaviors as the Malicious set by automatically building the multiple level tree, MLTree from distinctive network traces of each sample. Then, MBTree employs a detection algorithm to detect Malicious network traces that are similar to any MLTrees in the Malicious set. To illustrate the effectiveness of our proposed method, we adopt theoretical analysis of MBTree from the probability perspective. In addition, we have implemented MBTree to evaluate it on five datasets which are reorganized in a sophisticated manner for comprehensive assessment. The experimental results demonstrate the accurate and robust of MBTree, especially in the face of new emerging benign applications.