The Experts below are selected from a list of 135 Experts worldwide ranked by ideXlab platform

Christopher Kruegel - One of the best experts on this subject based on the ideXlab platform.

  • forecast skimming off the Malware cream
    Annual Computer Security Applications Conference, 2011
    Co-Authors: Matthias Neugschwandtner, Paolo Milani Comparetti, Gregoire Jacob, Christopher Kruegel
    Abstract:

    To handle the large number of Malware Samples appearing in the wild each day, security analysts and vendors employ automated tools to detect, classify and analyze malicious code. Because Malware is typically resistant to static analysis, automated dynamic analysis is widely used for this purpose. Executing malicious software in a controlled environment while observing its behavior can provide rich information on a Malware's capabilities. However, running each Malware Sample even for a few minutes is expensive. For this reason, Malware analysis efforts need to select a subset of Samples for analysis. To date, this selection has been performed either randomly or using techniques focused on avoiding re-analysis of polymorphic Malware variants [41, 23]. In this paper, we present a novel approach to Sample selection that attempts to maximize the total value of the information obtained from analysis, according to an application-dependent scoring function. To this end, we leverage previous work on behavioral Malware clustering [14] and introduce a machine-learning-based system that uses all statically-available information to predict into which behavioral class a Sample will fall, before the Sample is actually executed. We discuss scoring functions tailored at two practical applications of large-scale dynamic analysis: the compilation of network blacklists of command and control servers and the generation of remediation procedures for Malware infections. We implement these techniques in a tool called ForeCast. Large-scale evaluation on over 600,000 Malware Samples shows that our prototype can increase the amount of potential command and control servers detected by up to 137% over a random selection strategy and 54% over a selection strategy based on Sample diversity.

  • About Author(s) TTAnalyze: A Tool for Analyzing Malware
    2008
    Co-Authors: Ulrich Bayer, Christopher Kruegel, Engin Kirda
    Abstract:

    TTAnalyze: A Tool for Analyzing Malware Malware analysis is the process of determining the purpose and functionality of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete Malware from an infected machine. Traditionally, Malware analysis has been a manual process that is tedious and time-intensive. Unfortunately, the number of Samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emulation accuracy. These factors make TTAnalyze an ideal tool for quickly getting an understanding of the behavior of an unknown Malware

  • Exploring multiple execution paths for Malware analysis
    Proceedings - IEEE Symposium on Security and Privacy, 2007
    Co-Authors: Andreas Moser, Christopher Kruegel, Engin Kirda
    Abstract:

    Malicious code (or Malware) is defined as software that fulfills the deliberately harmful intent of an attacker. Malware analysis is the process of determining the behavior and purpose of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques and removal tools. Currently, Malware analysis is mostly a manual process that is tedious and time-intensive. To mitigate this problem, a number of analysis tools have been proposed that automatically extract the behavior of an unknown program by executing it in a restricted environment and recording the operating system calls that are invoked. The problem of dynamic analysis tools is that only a single program execution is observed. Unfortunately, however, it is possible that certain malicious actions are only triggered under specific circumstances (e.g., on a particular day, when a certain file is present, or when a certain command is received). In this paper, we propose a system that allows us to explore multiple execution paths and identify malicious actions that are executed only when certain conditions are met. This enables us to automatically extract a more complete view of the program under analysis and identify under which circumstances suspicious actions are carried out. Our experimental results demonstrate that many Malware Samples show different behavior depending on input read from the environment. Thus, by exploring multiple execution paths, we can obtain a more complete picture of their actions.

  • dynamic analysis of malicious code
    Journal in Computer Virology, 2006
    Co-Authors: Ulrich Bayer, Christopher Kruegel, Andreas Moser, Engin Kirda
    Abstract:

    Malware analysis is the process of determining the purpose and functionality of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete Malware from an infected machine. Traditionally, Malware analysis has been a manual process that is tedious and time- intensive. Unfortunately, the number of Samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that auto- mate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment,

  • TTAnalyze: A tool for analyzing Malware
    15th Ann. Conf. European Inst. for Computer Antivirus Research, 2006
    Co-Authors: Ulrich Bayer, Christopher Kruegel, Engin Kirda
    Abstract:

    Malware analysis is the process of determining the purpose and functionality of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete Malware froman infected machine. Traditionally, Malware analysis has been a manual process that is tedious and time-intensive. Unfortunately, the number of Samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior ofWindows executa- bles. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record theWindows native system calls andWindows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emu- lation accuracy. These factors make TTAnalyze an ideal tool for quickly getting an understanding of the behavior of an unknown Malware.

Engin Kirda - One of the best experts on this subject based on the ideXlab platform.

  • About Author(s) TTAnalyze: A Tool for Analyzing Malware
    2008
    Co-Authors: Ulrich Bayer, Christopher Kruegel, Engin Kirda
    Abstract:

    TTAnalyze: A Tool for Analyzing Malware Malware analysis is the process of determining the purpose and functionality of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete Malware from an infected machine. Traditionally, Malware analysis has been a manual process that is tedious and time-intensive. Unfortunately, the number of Samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emulation accuracy. These factors make TTAnalyze an ideal tool for quickly getting an understanding of the behavior of an unknown Malware

  • Exploring multiple execution paths for Malware analysis
    Proceedings - IEEE Symposium on Security and Privacy, 2007
    Co-Authors: Andreas Moser, Christopher Kruegel, Engin Kirda
    Abstract:

    Malicious code (or Malware) is defined as software that fulfills the deliberately harmful intent of an attacker. Malware analysis is the process of determining the behavior and purpose of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques and removal tools. Currently, Malware analysis is mostly a manual process that is tedious and time-intensive. To mitigate this problem, a number of analysis tools have been proposed that automatically extract the behavior of an unknown program by executing it in a restricted environment and recording the operating system calls that are invoked. The problem of dynamic analysis tools is that only a single program execution is observed. Unfortunately, however, it is possible that certain malicious actions are only triggered under specific circumstances (e.g., on a particular day, when a certain file is present, or when a certain command is received). In this paper, we propose a system that allows us to explore multiple execution paths and identify malicious actions that are executed only when certain conditions are met. This enables us to automatically extract a more complete view of the program under analysis and identify under which circumstances suspicious actions are carried out. Our experimental results demonstrate that many Malware Samples show different behavior depending on input read from the environment. Thus, by exploring multiple execution paths, we can obtain a more complete picture of their actions.

  • dynamic analysis of malicious code
    Journal in Computer Virology, 2006
    Co-Authors: Ulrich Bayer, Christopher Kruegel, Andreas Moser, Engin Kirda
    Abstract:

    Malware analysis is the process of determining the purpose and functionality of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete Malware from an infected machine. Traditionally, Malware analysis has been a manual process that is tedious and time- intensive. Unfortunately, the number of Samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that auto- mate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior of Windows executables. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record the Windows native system calls and Windows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment,

  • TTAnalyze: A tool for analyzing Malware
    15th Ann. Conf. European Inst. for Computer Antivirus Research, 2006
    Co-Authors: Ulrich Bayer, Christopher Kruegel, Engin Kirda
    Abstract:

    Malware analysis is the process of determining the purpose and functionality of a given Malware Sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques for malicious code. In addition, it is an important prerequisite for the development of removal tools that can thoroughly delete Malware froman infected machine. Traditionally, Malware analysis has been a manual process that is tedious and time-intensive. Unfortunately, the number of Samples that need to be analyzed by security vendors on a daily basis is constantly increasing. This clearly reveals the need for tools that automate and simplify parts of the analysis process. In this paper, we present TTAnalyze, a tool for dynamically analyzing the behavior ofWindows executa- bles. To this end, the binary is run in an emulated operating system environment and its (security-relevant) actions are monitored. In particular, we record theWindows native system calls andWindows API functions that the program invokes. One important feature of our system is that it does not modify the program that it executes (e.g., through API call hooking or breakpoints), making it more difficult to detect by malicious code. Also, our tool runs binaries in an unmodified Windows environment, which leads to excellent emu- lation accuracy. These factors make TTAnalyze an ideal tool for quickly getting an understanding of the behavior of an unknown Malware.

Daw Song - One of the best experts on this subject based on the ideXlab platform.

  • binary code extraction and interface identification for security applications
    Network and Distributed System Security Symposium, 2009
    Co-Authors: Jua Caballero, Noah M Johnso, Stephe Mccama, Daw Song
    Abstract:

    Abstract : Binary code reutilization is the process of automatically identifying the interface and extracting the instructions and data dependencies of a code fragment from an executable program, so that it is self-contained and can be reused by external code. Binary code reutilization is useful for a number of security applications, including reusing the proprietary cryptographic or unpacking functions from a Malware Sample and for rewriting a network dialog. In this paper we conduct the first systematic study of automated binary code reutilization and its security applications. The main challenge in binary code reutilization is understanding the code fragment's interface. We propose a novel technique to identify the prototype of an undocumented code fragment directly from the program's binary, without access to source code or symbol information. Further, we must also extract the code itself from the binary so that it is self-contained and can be easily reused in another program. We design and implement a tool that uses a combination of dynamic and static analysis to automatically identify the prototype and extract the instructions of an assembly function into a form that can be reused by other C code. The extracted function can be run independently of the rest of the program's functionality and shared with other users. We apply our approach to scenarios that include extracting the encryption and decryption routines from Malware Samples, and show that these routines can be reused by a network proxy to decrypt encrypted traffic on the network. This allows the network proxy to rewrite the Malware's encrypted traffic by combining the extracted encryption and decryption functions with the session keys and the protocol grammar.

Gavin Mcwilliams - One of the best experts on this subject based on the ideXlab platform.

  • analysis of bayesian classification based approaches for android Malware detection
    arXiv: Cryptography and Security, 2016
    Co-Authors: Suleiman Y Yerima, Sakir Sezer, Gavin Mcwilliams
    Abstract:

    Mobile Malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in Malware targeting the platform. Additionally, Android Malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new Malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android Malware. Hence, in this paper we develop and analyze proactive Machine Learning approaches based on Bayesian classification aimed at uncovering unknown Android Malware via static analysis. The study, which is based on a large Malware Sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification based solutions for detecting unknown Android Malware.

  • Analysis of Bayesian classification-based approaches for Android Malware detection
    IET Information Security, 2013
    Co-Authors: Gavin Mcwilliams, Sakir Sezer, Suleiman Y Yerima
    Abstract:

    Mobile Malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in Malware targeting the platform. Additionally, Android Malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new Malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android Malware. Hence, the authors develop and analyse proactive machine-learning approaches based on Bayesian classification aimed at uncovering unknown Android Malware via static analysis. The study, which is based on a large Malware Sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification-based solutions for detecting unknown Android Malware.

Suleiman Y Yerima - One of the best experts on this subject based on the ideXlab platform.

  • analysis of bayesian classification based approaches for android Malware detection
    arXiv: Cryptography and Security, 2016
    Co-Authors: Suleiman Y Yerima, Sakir Sezer, Gavin Mcwilliams
    Abstract:

    Mobile Malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in Malware targeting the platform. Additionally, Android Malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new Malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android Malware. Hence, in this paper we develop and analyze proactive Machine Learning approaches based on Bayesian classification aimed at uncovering unknown Android Malware via static analysis. The study, which is based on a large Malware Sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification based solutions for detecting unknown Android Malware.

  • Analysis of Bayesian classification-based approaches for Android Malware detection
    IET Information Security, 2013
    Co-Authors: Gavin Mcwilliams, Sakir Sezer, Suleiman Y Yerima
    Abstract:

    Mobile Malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in Malware targeting the platform. Additionally, Android Malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new Malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android Malware. Hence, the authors develop and analyse proactive machine-learning approaches based on Bayesian classification aimed at uncovering unknown Android Malware via static analysis. The study, which is based on a large Malware Sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification-based solutions for detecting unknown Android Malware.