The Experts below are selected from a list of 10956 Experts worldwide ranked by ideXlab platform
Aggelos Kiayias - One of the best experts on this subject based on the ideXlab platform.
-
Scalability, fidelity and stealth in the DRAKVUF dynamic Malware Analysis system
Proceedings of the 30th Annual Computer Security Applications Conference on - ACSAC '14, 2014Co-Authors: Tamas K. Lengyel, Steve Maresca, Simon Vogl, Bryan D. Payne, George D. Webster, Aggelos KiayiasAbstract:Malware is one of the biggest security threats on the Internet today and deploying effective defensive solutions requires the rapid Analysis of a continuously increasing number of Malware samples. With the proliferation of metamorphic Malware the Analysis is further complicated as the efficacy of signature-based static Analysis systems is greatly reduced. While dynamic Malware Analysis is an effective alternative, the approach faces significant challenges as the ever increasing number of samples requiring Analysis places a burden on hardware resources. At the same time modern Malware can both detect the monitoring environment and hide in unmonitored corners of the system. In this paper we present DRAKVUF, a novel dynamic Malware Analysis system designed to address these challenges by building on the latest hardware virtualization extensions and the Xen hypervisor. We present a technique for improving stealth by initiating the execution of Malware samples without leaving any trace in the Analysis machine. We also present novel techniques to eliminate blind-spots created by kernel-mode rootkits by extending the scope of monitoring to include kernel internal functions, and to monitor file-system accesses through the kernel's heap allocations. With extensive tests performed on recent Malware samples we show that DRAKVUF achieves significant improvements in conserving hardware resources while providing a stealthy, in-depth view into the behavior of modern Malware.
-
ACSAC - Scalability, fidelity and stealth in the DRAKVUF dynamic Malware Analysis system
Proceedings of the 30th Annual Computer Security Applications Conference on - ACSAC '14, 2014Co-Authors: Tamas K. Lengyel, Steve Maresca, Bryan D. Payne, George D. Webster, Sebastian Vogl, Aggelos KiayiasAbstract:Malware is one of the biggest security threats on the Internet today and deploying effective defensive solutions requires the rapid Analysis of a continuously increasing number of Malware samples. With the proliferation of metamorphic Malware the Analysis is further complicated as the efficacy of signature-based static Analysis systems is greatly reduced. While dynamic Malware Analysis is an effective alternative, the approach faces significant challenges as the ever increasing number of samples requiring Analysis places a burden on hardware resources. At the same time modern Malware can both detect the monitoring environment and hide in unmonitored corners of the system. In this paper we present DRAKVUF, a novel dynamic Malware Analysis system designed to address these challenges by building on the latest hardware virtualization extensions and the Xen hypervisor. We present a technique for improving stealth by initiating the execution of Malware samples without leaving any trace in the Analysis machine. We also present novel techniques to eliminate blind-spots created by kernel-mode rootkits by extending the scope of monitoring to include kernel internal functions, and to monitor file-system accesses through the kernel's heap allocations. With extensive tests performed on recent Malware samples we show that DRAKVUF achieves significant improvements in conserving hardware resources while providing a stealthy, in-depth view into the behavior of modern Malware.
Heng Yin - One of the best experts on this subject based on the ideXlab platform.
-
Transparent and precise Malware Analysis using virtualization: from theory to practice
2013Co-Authors: Heng Yin, Lok Kwong YanAbstract:Dynamic Analysis is an important technique used in Malware Analysis and is complementary to static Analysis. Thus far, virtualization has been widely adopted for building fine-grained dynamic Analysis tools and this trend is expected to continue. Unlike User/Kernel space Malware Analysis platforms that essentially co-exist with Malware, virtualization based platforms benefit from isolation and fine-grained instrumentation support. Isolation makes it more difficult for Malware samples to disrupt Analysis and fine-grained instrumentation provides analysts with low level details, such as those at the machine instruction level. This in turn supports the development of advanced Analysis tools such as dynamic taint Analysis and symbolic execution for automatic path exploration. The major disadvantage of virtualization based Malware Analysis is the loss of semantic information, also known as the semantic gap problem. To put it differently, since Analysis takes place at the virtual machine monitor where only the raw system state (e.g., CPU and memory) is visible, higher level constructs such as processes and files must be reconstructed using the low level information. The collection of techniques used to bridge semantic gaps is known as Virtual Machine Introspection. Virtualization based Analysis platforms can be further separated into emulation and hardware virtualization. Emulators have the advantages of flexibility of Analysis tool development and efficiency for fine-grained Analysis; however, emulators suffer from the transparency problem. That is, Malware can employ methods to determine whether it is executing in an emulated environment versus real hardware and cease operations to disrupt Analysis if the machine is emulated. In brief, emulation based dynamic Analysis has advantages over User/Kernel space and hardware virtualization based techniques, but it suffers from semantic gap and transparency problems. These problems have been exacerbated by recent discoveries of anti-emulation Malware that detects emulators and Android Malware with two semantic gaps, Java and native. Also, it is foreseeable that Malware authors will have a similar response to taint Analysis. In other words, once taint Analysis becomes widely used to understand how Malware operates, the authors will create new Malware that attacks the imprecisions in taint Analysis implementations and induce false-positives and false-negatives in an effort to frustrate analysts. This dissertation addresses these problems by presenting concepts, methods and techniques that can be used to transparently and precisely analyze both desktop and mobile Malware using virtualization. This is achieved in three parts. First, precise heterogeneous record and replay is presented as a means to help emulators benefit from the transparency characteristics of hardware virtualization. This technique is implemented in a tool called V2E that uses KVM for recording and TEMU for replaying and Analysis. It was successfully used to analyze real-world anti-emulation Malware that evaded Analysis using TEMU alone. Second, the design of an emulation based Android Malware Analysis platform that uses virtual machine introspection to bridge both the Java and native level semantic gaps as well as seamlessly bind the two views together into a single view is presented. The core introspection and instrumentation techniques were implemented in a new Analysis platform called DroidScope that is based on the Android emulator. It was successfully used to analyze two real-world Android Malware samples that have cooperating Java and native level components. Taint Analysis was also used to study their information ex-filtration behaviors. Third, formal methods for studying the sources of false-positives and false-negatives in dynamic taint Analysis designs and for verifying the correctnessof manually defined taint propagation rules are presented. These definitions and methods were successfully used to analyze and compare previously published taint Analysis platforms in terms of false-positives and false-negatives.
-
droidscope seamlessly reconstructing the os and dalvik semantic views for dynamic android Malware Analysis
USENIX Security Symposium, 2012Co-Authors: Lok Kwong Yan, Heng YinAbstract:The prevalence of mobile platforms, the large market share of Android, plus the openness of the Android Market makes it a hot target for Malware attacks. Once a Malware sample has been identified, it is critical to quickly reveal its malicious intent and inner workings. In this paper we present DroidScope, an Android Analysis platform that continues the tradition of virtualization-based Malware Analysis. Unlike current desktop Malware Analysis platforms, DroidScope reconstructs both the OS-level and Java-level semantics simultaneously and seamlessly. To facilitate custom Analysis, DroidScope exports three tiered APIs that mirror the three levels of an Android device: hardware, OS and Dalvik Virtual Machine. On top of DroidScope, we further developed several Analysis tools to collect detailed native and Dalvik instruction traces, profile API-level activity, and track information leakage through both the Java and native components using taint Analysis. These tools have proven to be effective in analyzing real world Malware samples and incur reasonably low performance overheads.
-
USENIX Security Symposium - DroidScope: seamlessly reconstructing the OS and Dalvik semantic views for dynamic Android Malware Analysis
2012Co-Authors: Lok Kwong Yan, Heng YinAbstract:The prevalence of mobile platforms, the large market share of Android, plus the openness of the Android Market makes it a hot target for Malware attacks. Once a Malware sample has been identified, it is critical to quickly reveal its malicious intent and inner workings. In this paper we present DroidScope, an Android Analysis platform that continues the tradition of virtualization-based Malware Analysis. Unlike current desktop Malware Analysis platforms, DroidScope reconstructs both the OS-level and Java-level semantics simultaneously and seamlessly. To facilitate custom Analysis, DroidScope exports three tiered APIs that mirror the three levels of an Android device: hardware, OS and Dalvik Virtual Machine. On top of DroidScope, we further developed several Analysis tools to collect detailed native and Dalvik instruction traces, profile API-level activity, and track information leakage through both the Java and native components using taint Analysis. These tools have proven to be effective in analyzing real world Malware samples and incur reasonably low performance overheads.
Amit Vasudevan - One of the best experts on this subject based on the ideXlab platform.
-
Effective Malware Analysis Using Stealth Breakpoints
Threats Countermeasures and Advances in Applied Information Security, 2012Co-Authors: Amit VasudevanAbstract:Fine-grained Malware Analysis requires various powerful Analysis tools. Chief among them is a debugger that enables runtime binary Analysis at the instruction level. One of the important services provided by a debugger is the ability to stop execution of code at arbitrary points during runtime, using breakpoints. Software breakpoints change the code being analyzed so that it can be interrupted during runtime. Most, if not all Malware are very sensitive to code modification with self-modifying and/or self-checking capabilities, rendering the use of software breakpoints limited in their scope. Hardware breakpoints on the other hand, use a subset of the CPU registers and exception mechanisms to provide breakpoints that do not entail code modification. However, hardware breakpoints support limited breakpoint ability (typically only 2-4 locations) and are susceptible to various anti-debugging techniques employed by Malware. This chapter describes a novel breakpoint technique (called stealth breakpoints) that provides unlimited number of breakpoints which are robust to detection and countering mechanisms. Further, stealth breakpoints retain all the features (code, data and I/O breakpoint abilities) of existing hardware and software breakpoint schemes and enables easy integration with existing debuggers.
-
Wildcat: an integrated stealth environment for dynamic Malware Analysis
2007Co-Authors: Ramesh Yerraballi, Amit VasudevanAbstract:Malware a term that refers to viruses, trojans, worms, spyware or any form of malicious code is widespread today. Given the devastating effects that Malware have on the computing world, detecting and countering Malware is an important goal. Malware Analysis is a challenging and multi-step process providing insight into Malware structure and functionality, facilitating the development of an antidote. To successfully detect and counter Malware, Malware analysts must be able to analyze them in binary, in both a coarse- (behavioral) and fine-grained (structural) fashion. However, current research in coarse- and fine-grained code Analysis (categorized into static and dynamic) have severe shortcomings in the context of Malware. Static approaches have been tailored towards Malware and allow exhaustive fine-grained malicious code Analysis, but lack support for self-modifying code, have limitations related to code-obfuscations and face the undecidability problem. Given that most if not all recent Malware employ self-modifying code and code-obfuscations, poses the need to analyze them at runtime using dynamic approaches. Current dynamic approaches for coarse- and fine-grained code Analysis are not tailored specifically towards Malware and lack support for multithreading, self-modifying/self-checking (SM-SC) code and are easily detected and countered by ever-evolving anti-Analysis tricks employed by Malware. To address this problem, we propose WiLDCAT, an integrated dynamic Malware Analysis environment that facilitates the Analysis and combat of Malware, that are ever-evolving, becoming evasive and increasingly hard to analyze. WiLDCAT cannot be detected or countered in any fashion and incorporates novel, patent pending strategies for both dynamic coarse- and fine-grained binary code Analysis, while remaining completely stealth. The environment allows comprehensive Analysis of Malware code-streams while selectively isolating them from other code-streams in real-time. WiLDCAT is portable, efficient and easy-to-use supporting multithreading, SM-SC code and any form of code obfuscations in both user and kernel-mode on commodity operating systems. It advances the state of the art in research pertaining to Malware Analysis by providing the toolkit that was sorely missing in the arsenal of Malware analysts, until now!
-
spike engineering Malware Analysis tools using unobtrusive binary instrumentation
ACSC '06 Proceedings of the 29th Australasian Computer Science Conference - Volume 48, 2006Co-Authors: Amit Vasudevan, Ramesh YerraballiAbstract:Malware -- a generic term that encompasses viruses, trojans, spywares and other intrusive code -- is widespread today. Malware Analysis is a multi-step process providing insight into Malware structure and functionality, facilitating the development of an antidote. Behavior monitoring, an important step in the Analysis process, is used to observe Malware interaction with respect to the system and is achieved by employing dynamic coarse-grained binary-instrumentation on the target system. However, current research involving dynamic binary-instrumentation, categorized into probe-based and just-in-time compilation (JIT), fail in the context of Malware. Probe-based schemes are not transparent. Most if not all Malware are sensitive to code modification incorporating methods to prevent their Analysis and even instrument the system themselves for their functionality and stealthness. Current JIT schemes, though transparent, do not support multithreading, self-modifying and/or self-checking (SM-SC) code and are unable to capture code running in kernel-mode. Also, they are an overkill in terms of latency for coarse-grained instrumentation.To address this problem, we have developed a new dynamic coarse-grained binary-instrumentation framework codenamed SPiKE, that aids in the construction of powerful Malware Analysis tools to combat Malware that are becoming increasingly hard to analyze. Our goal is to provide a binary-instrumentation framework that is unobtrusive, portable, efficient, easy-to-use and reusable, supporting multithreading and SM-SC code, both in user- and kernel-mode. In this paper, we discuss the concept of unobtrusive binary-instrumentation and present the design, implementation and evaluation of SPiKE. We also illustrate the framework utility by describing our experience with a tool employing SPiKE to analyze a real world Malware.
-
ACSC - SPiKE: engineering Malware Analysis tools using unobtrusive binary-instrumentation
2006Co-Authors: Amit Vasudevan, Ramesh YerraballiAbstract:Malware -- a generic term that encompasses viruses, trojans, spywares and other intrusive code -- is widespread today. Malware Analysis is a multi-step process providing insight into Malware structure and functionality, facilitating the development of an antidote. Behavior monitoring, an important step in the Analysis process, is used to observe Malware interaction with respect to the system and is achieved by employing dynamic coarse-grained binary-instrumentation on the target system. However, current research involving dynamic binary-instrumentation, categorized into probe-based and just-in-time compilation (JIT), fail in the context of Malware. Probe-based schemes are not transparent. Most if not all Malware are sensitive to code modification incorporating methods to prevent their Analysis and even instrument the system themselves for their functionality and stealthness. Current JIT schemes, though transparent, do not support multithreading, self-modifying and/or self-checking (SM-SC) code and are unable to capture code running in kernel-mode. Also, they are an overkill in terms of latency for coarse-grained instrumentation.To address this problem, we have developed a new dynamic coarse-grained binary-instrumentation framework codenamed SPiKE, that aids in the construction of powerful Malware Analysis tools to combat Malware that are becoming increasingly hard to analyze. Our goal is to provide a binary-instrumentation framework that is unobtrusive, portable, efficient, easy-to-use and reusable, supporting multithreading and SM-SC code, both in user- and kernel-mode. In this paper, we discuss the concept of unobtrusive binary-instrumentation and present the design, implementation and evaluation of SPiKE. We also illustrate the framework utility by describing our experience with a tool employing SPiKE to analyze a real world Malware.
Hendrik Pilz - One of the best experts on this subject based on the ideXlab platform.
-
IMF - Platform Independent Malware Analysis Framework
2015 Ninth International Conference on IT Security Incident Management & IT Forensics, 2015Co-Authors: Ulf Losche, Maik Morgenstern, Hendrik PilzAbstract:Over the past years malicious software has evolved to a persistent threat on all major computer platforms. Due tothe high number of new threats which are released every day security researchers have developed automatic systems toanalyze and classify unknown pieces of software. While these techniques are technically mature on the Windows platformthey still have to be improved on many other platforms such as Linux and Mac OS X. As the process of Malware Analysis isvery similar on all platforms we have developed a platform independent framework to easily implement Malware Analysison a new platform. This paper will cover our experience with Malware Analysis and we will show our generic approach,which can be applied on any platform.
Alexander Meduna - One of the best experts on this subject based on the ideXlab platform.
-
design of a retargetable decompiler for a static platform independent Malware Analysis
International Conference on Information Security, 2011Co-Authors: Lukas ďurfina, Jakub Křoustek, Petr Zemek, Dusan Kolař, Tomas Hruska, Karel Masařik, Alexander MedunaAbstract:Together with the massive expansion of smartphones, tablets, and other smart devices, we can notice a growing number of Malware threats targeting these platforms. Software security companies are not prepared for such diversity of target platforms and there are only few techniques for platform-independent Malware Analysis. This is a major security issue these days. In this paper, we propose a concept of a retargetable reverse compiler (i.e. a decompiler), which is in an early stage of development. The retargetable decompiler transforms platform-specific binary applications into a high-level language (HLL) representation, which can be further analyzed in a uniform way. This tool will help with a static platform-independent Malware Analysis. Our unique solution is based on an exploitation of two systems that were originally not intended for such an application—the architecture description language (ADL) ISAC for a platform description and the LLVM Compiler System as the core of the decompiler. In this study, we show that our tool can produce highly readable HLL code.
-
ISA - Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis
Communications in Computer and Information Science, 2011Co-Authors: Lukáš Ďurfina, Jakub Křoustek, Petr Zemek, Dusan Kolař, Tomas Hruska, Karel Masařik, Alexander MedunaAbstract:Together with the massive expansion of smartphones, tablets, and other smart devices, we can notice a growing number of Malware threats targeting these platforms. Software security companies are not prepared for such diversity of target platforms and there are only few techniques for platform-independent Malware Analysis. This is a major security issue these days. In this paper, we propose a concept of a retargetable reverse compiler (i.e. a decompiler), which is in an early stage of development. The retargetable decompiler transforms platform-specific binary applications into a high-level language (HLL) representation, which can be further analyzed in a uniform way. This tool will help with a static platform-independent Malware Analysis. Our unique solution is based on an exploitation of two systems that were originally not intended for such an application—the architecture description language (ADL) ISAC for a platform description and the LLVM Compiler System as the core of the decompiler. In this study, we show that our tool can produce highly readable HLL code.