The Experts below are selected from a list of 360 Experts worldwide ranked by ideXlab platform
Konrad Rieck - One of the best experts on this subject based on the ideXlab platform.
-
Malheur: A Tool for Automatic Analysis of Malware Behavior (0.5.4)
2018Co-Authors: Konrad RieckAbstract:Malheur is a tool for the automatic analysis of malware behavior (program behavior recorded from Malicious Software in a sandbox environment). It has been designed to support the regular analysis of Malicious Software and the development of detection and defense measures. Malheur allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes. It supports four basic actions for analysis which can be applied to reports of recorded behavior: Extraction of prototypes: From a given set of reports, malheur identifies a subset of prototypes representative for the full data set. The prototypes provide a quick overview of recorded behavior and can be used to guide manual inspection. Clustering of behavior Malheur automatically identifies groups (clusters) of reports containing similar behavior. Clustering allows for discovering novel classes of malware and provides the basis for crafting specific detection and defense mechanisms, such as anti-virus signatures. Classification of behavior: Based on a set of previously clustered reports, malheur is able to assign unknown behavior to known groups of malware. Classification enables identifying novel and unknown variants of malware and can be used to filter program behavior prior to manual inspection. Incremental analysis: Malheur can be applied incrementally for analysis of large data sets. By processing reports in chunks, the run-time as well as memory requirements can be significantly reduced. This renders long-term application of malheur feasible, for example for daily analysis of incoming malware programs. A detailed description of these techniques as well as technical background on analysis of Malicious Software is provided in the following articles: "Automatic Analysis of Malware Behavior using Machine Learning." Konrad Rieck, Philipp Trinius, Carsten Willems, and Thorsten Holz Journal of Computer Security (JCS), 19 (4) 639-668, 2011. "A Malware Instruction Set for Behavior-Based Analysis." Philipp Trinius, Carsten Willems, Thorsten Holz, and Konrad Rieck Technical report TR-2009-07, University of Mannheim, 2009
-
off the beaten path machine learning for offensive security
Proceedings of the 2013 ACM workshop on Artificial intelligence and security, 2013Co-Authors: Konrad RieckAbstract:Machine learning has been widely used for defensive security. Numerous approaches have been devised that make use of learning techniques for detecting attacks and Malicious Software. By contrast, only very few research has studied how machine learning can be applied for offensive security. In this talk, we will explore this research direction and show how learning methods can be used for discovering vulnerabilities in Software, finding information leaks in protected data, or supporting network reconnaissance. We discuss advantages and challenges of learning for offensive security as well as identify directions for future research.
-
automatic analysis of malware behavior using machine learning
Journal of Computer Security, 2011Co-Authors: Konrad Rieck, Philipp Trinius, Carsten Willems, Thorsten Holz_aff2n3Abstract:Malicious Software - so called malware - poses a major threat to the security of computer systems. The amount and diversity of its variants render classic security defenses ineffective, such that millions of hosts in the Internet are infected with malware in the form of computer viruses, Internet worms and Trojan horses. While obfuscation and polymorphism employed by malware largely impede detection at file level, the dynamic analysis of malware binaries during run-time provides an instrument for characterizing and defending against the threat of Malicious Software. In this article, we propose a framework for the automatic analysis of malware behavior using machine learning. The framework allows for automatically identifying novel classes of malware with similar behavior (clustering) and assigning unknown malware to these discovered classes (classification). Based on both, clustering and classification, we propose an incremental approach for behavior-based analysis, capable of processing the behavior of thousands of malware binaries on a daily basis. The incremental analysis significantly reduces the run-time overhead of current analysis methods, while providing accurate discovery and discrimination of novel malware variants.
-
Botzilla: Detecting the "Phoning Home" of Malicious Software
Proceedings of the 2010 ACM Symposium on Applied Computing - SAC '10, 2010Co-Authors: Konrad Rieck, Guido Schwenk, Tobias Limmer, Thorsten Holz, Pavel LaskovAbstract:Hosts infected with Malicious Software, so called malware, are ubiquitous in todays computer networks. The means whereby malware can infiltrate a network are manifold and range from exploiting of Software vulnerabilities to tricking a user into executing Malicious code. Monitoring and detection of all possible infection vectors is intractable in practice. Hence, we approach the problem of detecting Malicious Software at a later point when it initiates contact with its maintainer; a process referred to as "phoning home". In particular, we introduce Botzilla, a method for detection of malware communication, which proceeds by repetitively recording network traffic of malware in a controlled environment and generating network signatures from invariant content patterns. Experiments conducted at a large university network demonstrate the ability of Botzilla to accurately identify malware communication in network traffic with very low false-positive rates.
-
a malware instruction set for behavior based analysis
Sicherheit, 2009Co-Authors: Philipp Trinius, Carsten Willems, Thorsten Holz, Konrad RieckAbstract:We introduce a new representation for monitored behavior of Malicious Software called Malware Instruction Set (MIST). The representation is optimized for effective and efficient analysis of behavior using data mining and machine learning techniques. It can be obtained automatically during analysis of malware with a behavior monitoring tool or by converting existing behavior reports. The representation is not restricted to a particular monitoring tool and thus can also be used as a meta language to unify behavior reports of different sources.
Jaswinder Singh - One of the best experts on this subject based on the ideXlab platform.
-
detection of Malicious Software by analyzing the behavioral artifacts using machine learning algorithms
Information & Software Technology, 2020Co-Authors: Jagbir Singh, Jaswinder SinghAbstract:Abstract Malicious Software deliberately affects the computer systems. Malware are analyzed using static or dynamic analysis techniques. Using these techniques, unique patterns are extracted to detect malware correctly. In this paper, a behavior-based malware detection technique is proposed. Various runtime features are extracted by setting up a dynamic analysis environment using the Cuckoo sandbox. Three primary features are processed for developing malware classifier. Firstly, printable strings are processed word by word using text mining techniques which produced a very high dimension matrix of the string features. Then we apply the singular value decomposition technique for reducing dimensions of string features. Secondly, Shannon entropy is computed over the printable strings and API calls to consider the randomness of API and PSI features. In addition to these features, behavioral features regarding file operations, registry key modification and network activities are used in malware detection. Finally, all features are integrated in the training feature set to develop the malware classifiers using the machine learning algorithms. The proposed technique is validated with 16489 malware and 8422 benign files. Our experimental results show the accuracy of 99.54% in malware detection using ensemble machine learning algorithms. Moreover, it aims to develop a behavior-based malware detection technique of high accuracy by processing the runtime features in a new way.
M. Schmid - One of the best experts on this subject based on the ideXlab platform.
-
protecting data from Malicious Software
Annual Computer Security Applications Conference, 2002Co-Authors: M. Schmid, F Hill, A K GhoshAbstract:Corruption or disclosure of sensitive user documents can be among the most lasting and costly effects of Malicious Software attacks. Many Malicious programs specifically target files that are likely to contain important user data. Researchers have approached this problem by developing techniques for restricting access to resources on an application-by-application basis. These so-called "sandbox environments," though effective, are cumbersome and difficult to use. In this paper, we present a prototype Windows NT/2000 tool that addresses Malicious Software threats to user data by extending the existing set of file-access permissions. Management and configuration options make the tool unobtrusive and easy to use. We have conducted preliminary experiments to assess the usability of the tool and to evaluate the effects of improvements we have made. Our work has produced an intuitive data-centric method of protecting valuable documents that provides an additional layer of defense beyond existing antivirus solutions.
-
A toolkit for detecting and analyzing Malicious Software
18th Annual Computer Security Applications Conference 2002. Proceedings., 2002Co-Authors: M. Weber, M. Schätz, M. Schmid, D GeyerAbstract:We present PEAT: the Portable Executable Analysis Toolkit. It is a Software prototype designed to provide a selection of tools that an analyst may use in order to examine structural aspects of a Windows Portable Executable (PE) file, with the goal of determining whether Malicious code has been inserted into an application after compilation. These tools rely on structural features of executables that are likely to indicate the presence of inserted Malicious code. The underlying premise is that typical application programs are compiled into one binary, homogeneous from beginning to end with respect to certain structural features; any disruption of this homogeneity is a strong indicator that the binary has been tampered with. For example, it could now harbor a virus or a Trojan horse program. We present our investigation into structural feature analysis, the development of these ideas into the PEAT prototype, and results that illustrate PEAT's practical effectiveness.
-
A toolkit for detecting and analyzing Malicious Software
2002Co-Authors: M. Weber, M. Schätz, M. Schmid, D GeyerAbstract:In this paper we present PEAT: The Portable Executable Analysis Toolkit. It is a Software prototype designed to pro-vide a selection of tools that an analyst may use in order to examine structural aspects of a Windows Portable Ex-ecutable (PE) file, with the goal of determining whether Malicious code has been inserted into an application af-ter compilation. These tools rely on structural features of executables that are likely to indicate the presence of in-serted Malicious code. The underlying premise is that typi-cal application programs are compiled into one binary, ho-mogeneous from beginning to end with respect to certain structural features; any disruption of this homogeneity is a strong indicator that the binary has been tampered with. For example, it could now harbor a virus or a Trojan horse program. We present our investigation into structural fea-ture analysis, the development of these ideas into the PEAT prototype, and results that illustrate PEAT’s practical ef-fectiveness. 1
-
PEAT- a toolkit for detecting and analyzing Malicious Software
Press, 2002Co-Authors: M. Weber, D Geyer, M. Schmid, M. SchätzAbstract:In this paper we present PEAT: The Portable Executable Analysis Toolkit. It is a Software prototype designed to provide a selection of tools that an analyst may use in order to examine structural aspects of a Windows Portable Executable (PE) file, with the goal of determining whether Malicious code has been inserted into an application after compilation. These tools rely on structural features of executables that are likely to indicate the presence of inserted Malicious code. The underlying premise is that typical application programs are compiled into one binary, homogeneous from beginning to end with respect to certain structural features; any disruption of this homogeneity is a strong indicator that the binary has been tampered with. For example, it could now harbor a virus or a Trojan horse program. We present our investigation into structural feature analysis, the development of these ideas into the PEAT prototype, and results that illustrate PEAT’s practical effectiveness. 1
-
Protecting data from Malicious Software
2002Co-Authors: M. Schmid, F Hill, Cigital Inc, A K GhoshAbstract:Corruption or disclosure of sensitive user documents can be among the most lasting and costly effects of Malicious Software attacks. Many Malicious programs specifically target files that are likely to contain important user data. Researchers have approached this problem by developing techniques for restricting access to resources on an application-by-application basis. These so-called “sandbox environments, ” though effective, are cumbersome and difficult to use. In this paper, we present a prototype Windows NT/2000 tool that addresses Malicious Software threats to user data by extending the existing set of file-access permissions. Management and configuration options make the tool unobtrusive and easy to use. We have conducted preliminary experiments to assess the usability of the tool and to evaluate the effects of improvements we have made. Our work has produced an intuitive data-centric method of protecting valuable documents that provides an additional layer of defense beyond existing antivirus solutions. to produce. After all, the computer and its Software are simply tools being used to aid in the creation of this data in the first place. While corporations may be legitimately concerned with side effects such as system availability and the resources required to eradicate an out-of-control virus, users are ultimately concerned with the integrity and confidentiality of the data contained in their files. The Windows NT / 2000 security model provides users with the ability to protect sensitive documents from access by other users. The type of access control provided by Windows is known as discretionary access control (DAC) because the owner of a file is given discretion in determining the access permissions for that file. This is in contrast with mandatory access control (MAC) where file permissions are much more tightly controlled [16]. Figure 1 shows the Windows NT 4.0 dialog box that enables a user to select file permissions for a document. 1
D Geyer - One of the best experts on this subject based on the ideXlab platform.
-
A toolkit for detecting and analyzing Malicious Software
18th Annual Computer Security Applications Conference 2002. Proceedings., 2002Co-Authors: M. Weber, M. Schätz, M. Schmid, D GeyerAbstract:We present PEAT: the Portable Executable Analysis Toolkit. It is a Software prototype designed to provide a selection of tools that an analyst may use in order to examine structural aspects of a Windows Portable Executable (PE) file, with the goal of determining whether Malicious code has been inserted into an application after compilation. These tools rely on structural features of executables that are likely to indicate the presence of inserted Malicious code. The underlying premise is that typical application programs are compiled into one binary, homogeneous from beginning to end with respect to certain structural features; any disruption of this homogeneity is a strong indicator that the binary has been tampered with. For example, it could now harbor a virus or a Trojan horse program. We present our investigation into structural feature analysis, the development of these ideas into the PEAT prototype, and results that illustrate PEAT's practical effectiveness.
-
A toolkit for detecting and analyzing Malicious Software
2002Co-Authors: M. Weber, M. Schätz, M. Schmid, D GeyerAbstract:In this paper we present PEAT: The Portable Executable Analysis Toolkit. It is a Software prototype designed to pro-vide a selection of tools that an analyst may use in order to examine structural aspects of a Windows Portable Ex-ecutable (PE) file, with the goal of determining whether Malicious code has been inserted into an application af-ter compilation. These tools rely on structural features of executables that are likely to indicate the presence of in-serted Malicious code. The underlying premise is that typi-cal application programs are compiled into one binary, ho-mogeneous from beginning to end with respect to certain structural features; any disruption of this homogeneity is a strong indicator that the binary has been tampered with. For example, it could now harbor a virus or a Trojan horse program. We present our investigation into structural fea-ture analysis, the development of these ideas into the PEAT prototype, and results that illustrate PEAT’s practical ef-fectiveness. 1
-
PEAT- a toolkit for detecting and analyzing Malicious Software
Press, 2002Co-Authors: M. Weber, D Geyer, M. Schmid, M. SchätzAbstract:In this paper we present PEAT: The Portable Executable Analysis Toolkit. It is a Software prototype designed to provide a selection of tools that an analyst may use in order to examine structural aspects of a Windows Portable Executable (PE) file, with the goal of determining whether Malicious code has been inserted into an application after compilation. These tools rely on structural features of executables that are likely to indicate the presence of inserted Malicious code. The underlying premise is that typical application programs are compiled into one binary, homogeneous from beginning to end with respect to certain structural features; any disruption of this homogeneity is a strong indicator that the binary has been tampered with. For example, it could now harbor a virus or a Trojan horse program. We present our investigation into structural feature analysis, the development of these ideas into the PEAT prototype, and results that illustrate PEAT’s practical effectiveness. 1
Jagbir Singh - One of the best experts on this subject based on the ideXlab platform.
-
detection of Malicious Software by analyzing the behavioral artifacts using machine learning algorithms
Information & Software Technology, 2020Co-Authors: Jagbir Singh, Jaswinder SinghAbstract:Abstract Malicious Software deliberately affects the computer systems. Malware are analyzed using static or dynamic analysis techniques. Using these techniques, unique patterns are extracted to detect malware correctly. In this paper, a behavior-based malware detection technique is proposed. Various runtime features are extracted by setting up a dynamic analysis environment using the Cuckoo sandbox. Three primary features are processed for developing malware classifier. Firstly, printable strings are processed word by word using text mining techniques which produced a very high dimension matrix of the string features. Then we apply the singular value decomposition technique for reducing dimensions of string features. Secondly, Shannon entropy is computed over the printable strings and API calls to consider the randomness of API and PSI features. In addition to these features, behavioral features regarding file operations, registry key modification and network activities are used in malware detection. Finally, all features are integrated in the training feature set to develop the malware classifiers using the machine learning algorithms. The proposed technique is validated with 16489 malware and 8422 benign files. Our experimental results show the accuracy of 99.54% in malware detection using ensemble machine learning algorithms. Moreover, it aims to develop a behavior-based malware detection technique of high accuracy by processing the runtime features in a new way.