The Experts below are selected from a list of 72 Experts worldwide ranked by ideXlab platform

Jennifer Mankin - One of the best experts on this subject based on the ideXlab platform.

  • Classification of malware persistence mechanisms using low-artifact disk instrumentation
    2013
    Co-Authors: David Kaeli, Jennifer Mankin
    Abstract:

    The proliferation of malware in recent years has motivated the need for tools to analyze, classify, and understand intrusions. Current research in analyzing malware focuses on labeling malware as malicious or benign, or labeling it with the family or variant it belongs to. We argue that, in addition to providing coarse family labels, it is useful to label malware by the capabilities they employ. Capabilities can include keystroke logging, downloading a file from the internet, modifying the Master Boot Record, and trojanizing a system binary. Unfortunately, labeling malware by capability requires a descriptive, high-integrity trace of malware behavior, which is challenging given the complex stealth techniques that malware employ in order to evade analysis and detection. In this thesis, we present DIONE, a flexible rule-based disk I/O monitoring and analysis infrastructure. DIONE interposes between a system-under-analysis and its hard disk, intercepting disk accesses and reconstructing high-level file system and registry changes as they occur. We evaluate the accuracy and performance of DIONE, and show that it can achieve 100% accuracy in reconstructing file system operations, with a performance penalty less than 2% in many cases. Given the trustworthy behavioral traces obtained by DIONE, we convert file system-level events to high-level capabilities. For this, we use model checking, a formal verification approach that compares a model extracted from a behavioral trace to a given specification. Since we use DIONE traces of file system and registry events, we aim to label persistence capabilities—that is, we label a sample by the mechanism it uses not only to persist on disk, but to restart after a system Boot. We model the Windows service, a commonly-employed capability used by malware to persist, load a binary after reBoot, and even load dangerous code into the kernel. We model the installation of a Windows service, the system Boot, and the file access of the service binary. We test our models on over 1000 real-world malware samples, and show that it successfully identifies service-installing malware samples over 99% of the time, and malware that loads that service over 97% of the time. Moreover, we demonstrate that we are able to use traces of disk reads to differentiate between two types of file accesses. We show that we can not only detect when a persistence mechanism is installed, but also that the persistence mechanism is successful because we detect the automatic load of the program binary after a system reBoot. We correctly identify file access types from disk access patterns with less than 4% of samples mislabeled, and demonstrate that even an expert analyst would have difficulty correctly identifying the mislabeled accesses.

  • CLASSIFICATION OF MALWARE PERSISTENCE MECHANISMS USING LOW-ARTIFACT DISK INSTRUMENTATION
    2013
    Co-Authors: Jennifer Mankin
    Abstract:

    The proliferation of malware in recent years has motivated the need for tools to an-alyze, classify, and understand intrusions. Current research in analyzing malware focuses either on labeling malware by its maliciousness (e.g., malicious or benign) or classifying it by the variant it belongs to. We argue that, in addition to provid-ing coarse family labels, it is useful to label malware by the capabilities they em-ploy. Capabilities can include keystroke logging, downloading a file from the internet, modifying the Master Boot Record, and trojanizing a system binary. Unfortunately, labeling malware by capability requires a descriptive, high-integrity trace of malware behavior, which is challenging given the complex stealth techniques that malware employ in order to evade analysis and detection. In this thesis, we present Dione, a flexible rule-based disk I/O monitoring and analysis infrastructure. Dione interposes between a system-under-analysis and its hard disk, intercepting disk accesses and re-constructing high-level file system and registry changes as they occur. We evaluate the accuracy and performance of Dione, and show that it can achieve 100 % accurac

David Kaeli - One of the best experts on this subject based on the ideXlab platform.

  • Classification of malware persistence mechanisms using low-artifact disk instrumentation
    2013
    Co-Authors: David Kaeli, Jennifer Mankin
    Abstract:

    The proliferation of malware in recent years has motivated the need for tools to analyze, classify, and understand intrusions. Current research in analyzing malware focuses on labeling malware as malicious or benign, or labeling it with the family or variant it belongs to. We argue that, in addition to providing coarse family labels, it is useful to label malware by the capabilities they employ. Capabilities can include keystroke logging, downloading a file from the internet, modifying the Master Boot Record, and trojanizing a system binary. Unfortunately, labeling malware by capability requires a descriptive, high-integrity trace of malware behavior, which is challenging given the complex stealth techniques that malware employ in order to evade analysis and detection. In this thesis, we present DIONE, a flexible rule-based disk I/O monitoring and analysis infrastructure. DIONE interposes between a system-under-analysis and its hard disk, intercepting disk accesses and reconstructing high-level file system and registry changes as they occur. We evaluate the accuracy and performance of DIONE, and show that it can achieve 100% accuracy in reconstructing file system operations, with a performance penalty less than 2% in many cases. Given the trustworthy behavioral traces obtained by DIONE, we convert file system-level events to high-level capabilities. For this, we use model checking, a formal verification approach that compares a model extracted from a behavioral trace to a given specification. Since we use DIONE traces of file system and registry events, we aim to label persistence capabilities—that is, we label a sample by the mechanism it uses not only to persist on disk, but to restart after a system Boot. We model the Windows service, a commonly-employed capability used by malware to persist, load a binary after reBoot, and even load dangerous code into the kernel. We model the installation of a Windows service, the system Boot, and the file access of the service binary. We test our models on over 1000 real-world malware samples, and show that it successfully identifies service-installing malware samples over 99% of the time, and malware that loads that service over 97% of the time. Moreover, we demonstrate that we are able to use traces of disk reads to differentiate between two types of file accesses. We show that we can not only detect when a persistence mechanism is installed, but also that the persistence mechanism is successful because we detect the automatic load of the program binary after a system reBoot. We correctly identify file access types from disk access patterns with less than 4% of samples mislabeled, and demonstrate that even an expert analyst would have difficulty correctly identifying the mislabeled accesses.

Troy Taylor Davidson - One of the best experts on this subject based on the ideXlab platform.

Hanspeter Merkel - One of the best experts on this subject based on the ideXlab platform.

Tilo Muller - One of the best experts on this subject based on the ideXlab platform.

  • Mutual Authentication and Trust Bootstrapping towards Secure Disk Encryption
    ACM Transactions on Information and System Security, 2014
    Co-Authors: Johannes Götzfried, Tilo Muller
    Abstract:

    The weakest link in software-based full disk encryption is the authentication procedure. Since the Master Boot Record must be present unencrypted in order to launch the decryption of remaining system parts, it can easily be manipulated and infiltrated by Bootkits that perform keystroke logging; consequently, password-based authentication schemes become attackable. The current technological response, as enforced by BitLocker, verifies the integrity of the Boot process by use of the trusted platform module. But, as we show, this countermeasure is insufficient in practice. We present STARK, the first tamperproof authentication scheme that mutually authenticates the computer and the user in order to resist keylogging during Boot. To achieve this, STARK implements trust Bootstrapping from a secure token to the whole PC. The secure token is an active USB drive that verifies the integrity of the PC and indicates the verification status by an LED to the user. This way, users can ensure the authenticity of the PC before entering their passwords.