The Experts below are selected from a list of 114 Experts worldwide ranked by ideXlab platform
Roberto Baldoni - One of the best experts on this subject based on the ideXlab platform.
-
AndroDFA: Android Malware Classification Based on Resource Consumption
Information, 2020Co-Authors: Luca Massarelli, Leonardo Aniello, Leonardo Querzoni, Claudio Ciccotelli, Daniele Ucci, Roberto BaldoniAbstract:The vast majority of today’s mobile malware targets Android devices. An important task of malware analysis is the classification of malicious samples into known families. In this paper, we propose AndroDFA (DFA, detrended fluctuation analysis): an approach to Android malware family classification based on dynamic analysis of resource consumption metrics available from the Proc File System. These metrics can be easily measured during sample execution. From each malware, we extract features through detrended fluctuation analysis (DFA) and Pearson’s correlation, then a support vector machine is employed to classify malware into families. We provide an experimental evaluation based on malware samples from two datasets, namely Drebin and AMD. With the Drebin dataset, we obtained a classification accuracy of 82%, comparable with works from the state-of-the-art like DroidScribe. However, compared to DroidScribe, our approach is easier to reproduce because it is based on publicly available tools only, does not require any modification to the emulated environment or Android OS, and by design, can also be used on physical devices rather than exclusively on emulators. The latter is a key factor because modern mobile malware can detect the emulated environment and hide its malicious behavior. The experiments on the AMD dataset gave similar results, with an overall mean accuracy of 78%. Furthermore, we made the software we developed publicly available, to ease the reproducibility of our results.
-
Android Malware Family Classification Based on Resource Consumption over Time
arXiv: Cryptography and Security, 2017Co-Authors: Luca Massarelli, Leonardo Aniello, Leonardo Querzoni, Claudio Ciccotelli, Daniele Ucci, Roberto BaldoniAbstract:The vast majority of today's mobile malware targets Android devices. This has pushed the research effort in Android malware analysis in the last years. An important task of malware analysis is the classification of malware samples into known families. Static malware analysis is known to fall short against techniques that change static characteristics of the malware (e.g. code obfuscation), while dynamic analysis has proven effective against such techniques. To the best of our knowledge, the most notable work on Android malware family classification purely based on dynamic analysis is DroidScribe. With respect to DroidScribe, our approach is easier to reproduce. Our methodology only employs publicly available tools, does not require any modification to the emulated environment or Android OS, and can collect data from physical devices. The latter is a key factor, since modern mobile malware can detect the emulated environment and hide their malicious behavior. Our approach relies on resource consumption metrics available from the Proc File System. Features are extracted through detrended fluctuation analysis and correlation. Finally, a SVM is employed to classify malware into families. We provide an experimental evaluation on malware samples from the Drebin dataset, where we obtain a classification accuracy of 82%, proving that our methodology achieves an accuracy comparable to that of DroidScribe. Furthermore, we make the software we developed publicly available, to ease the reproducibility of our results.
-
MALWARE - Android malware family classification based on resource consumption over time
2017 12th International Conference on Malicious and Unwanted Software (MALWARE), 2017Co-Authors: Luca Massarelli, Leonardo Aniello, Leonardo Querzoni, Claudio Ciccotelli, Daniele Ucci, Roberto BaldoniAbstract:The vast majority of today's mobile malware targets Android devices. This has pushed the research effort in Android malware analysis in the last years. An important task of malware analysis is the classification of malware samples into known families. Static malware analysis is known to fall short against techniques that change static characteristics of the malware (e.g. code obfuscation), while dynamic analysis has proven effective against such techniques. To the best of our knowledge, the most notable work on Android malware family classification purely based on dynamic analysis is DroidScribe. With respect to DroidScribe, our approach is easier to reproduce. Our methodology only employs publicly available tools, does not require any modification to the emulated environment or Android OS, and can collect data from physical devices. The latter is a key factor, since modern mobile malware can detect the emulated environment and hide their malicious behaviour. Our approach relies on resource consumption metrics available from the Proc File System. Features are extracted through detrended fluctuation analysis and correlation. Finally, a SVM is employed to classify malware into families. We provide an experimental evaluation on malware samples from the Drebin dataset, where we obtain a classification accuracy of 82%c, proving that our methodology achieves an accuracy comparable to that of DroidScribe. Furthermore, we make the software we developed publicly available, to ease the reproducibility of our results.
Albert Alexandrov - One of the best experts on this subject based on the ideXlab platform.
-
User-level operating System extensions based on System call interposition
1999Co-Authors: Albert Alexandrov, Klaus E. SchauserAbstract:Extensibility is becoming a very important issue in modern operating Systems. Extensible operating Systems can easily adapt to satisfy the requirements of new emerging applications. Although a lot of research has gone into designing extensible operating Systems, existing standard operating Systems are difficult to extend. In this dissertation we show how to extend standard operating Systems completely at the user level without actual modifications to the operating System itself. Our approach is based on System call interposition. It works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any re-linking or re-compilation of existing applications. In fact, the extensions can even be dynamically “installed” into already running Processes. The extensions work completely at the user level and install without System administrator assistance. Individual users can choose what extensions to run, in effect creating a personalized operating System view for themselves. We demonstrate the viability of our approach by implementing two significant operating System extensions: Ufo and Consh. Ufo is a global File System that provides transparent access to remote HTTP and FTP servers. Consh is a confined shell for protected execution that provides services needed for new Internet computing applications. Our detailed performance analysis of these extensions shows that while System call interposition incurs noticeable performance overhead on individual System calls, the overall overhead for complete applications is acceptable. Furthermore, we analyze the current implementation of the / Proc interface, identify the bottlenecks responsible for the overhead and propose minor changes to the operating System to overcome these bottlenecks. The changes are small enough to be easily incorporated in a future version of the operating System. We implement the changes in a current operating System and demonstrate the resulting improved performance in the Ufo extension.
-
UFO: a personal global File System based on user-level extensions to the operating System
ACM Transactions on Computer Systems, 1998Co-Authors: Albert Alexandrov, Maximilian Ibel, Klaus E. Schauser, Chris J. ScheimanAbstract:In this article we show how to extend a wide range of functionality of standard operation Systems completely at the user level. Our approach works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any relinking or recompilation of existing applications. In fact, the extensions can even be dynamically “installed” into already running Processes. The extensions work completely at the user level and install without System administrator assistance. Individual users can choose what extensions to run, in effect creating a personalized operating System view for themselves. We used this approach to implement a global File System, called Ufo, which allows users to treat remote Files exactly as if they were local. Currently, Ufo supports File access through the FTP and HTTP protocols and allows new protocols to be plugged in. While several other projects have implemented global File System abstractions, they all require either changes to the operating System or modifications to standard libraries. The article gives a detailed performance analysis of our approach to extending the OS and establishes that Ufo introduces acceptable overhead for common applications even though intercepting individual System calls incurs a high cost.
-
Extending the operating System at the user level: the Ufo global File System
1997Co-Authors: Albert Alexandrov, Maximilian Ibel, Klaus E. Schauser, Chris J. ScheimanAbstract:In this paper we show how to extend the functionality of standard operating Systems completely at the user level. Our approach works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any re-linking or recompilation of existing applications. In fact, the extensions can even be dynamically "installed" into already running Processes. The extensions work completely at the user level and install without System administrator assistance. We used this approach to implement a global File System, called Ufo, which allows users to treat remote Files exactly as if they were local. Currently, Ufo supports File access through the FTP and HTTP protocols and allows new protocols to be plugged in. While several other projects have implemented global File System abstractions, they all require either changes to the operating System or modifications to standard libraries. The paper gives a detailed performance analysis of our approach to extending the OS and establishes that Ufo introduces acceptable overhead for common applications even though intercepting System calls incurs a high cost.
Chris J. Scheiman - One of the best experts on this subject based on the ideXlab platform.
-
UFO: a personal global File System based on user-level extensions to the operating System
ACM Transactions on Computer Systems, 1998Co-Authors: Albert Alexandrov, Maximilian Ibel, Klaus E. Schauser, Chris J. ScheimanAbstract:In this article we show how to extend a wide range of functionality of standard operation Systems completely at the user level. Our approach works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any relinking or recompilation of existing applications. In fact, the extensions can even be dynamically “installed” into already running Processes. The extensions work completely at the user level and install without System administrator assistance. Individual users can choose what extensions to run, in effect creating a personalized operating System view for themselves. We used this approach to implement a global File System, called Ufo, which allows users to treat remote Files exactly as if they were local. Currently, Ufo supports File access through the FTP and HTTP protocols and allows new protocols to be plugged in. While several other projects have implemented global File System abstractions, they all require either changes to the operating System or modifications to standard libraries. The article gives a detailed performance analysis of our approach to extending the OS and establishes that Ufo introduces acceptable overhead for common applications even though intercepting individual System calls incurs a high cost.
-
Extending the operating System at the user level: the Ufo global File System
1997Co-Authors: Albert Alexandrov, Maximilian Ibel, Klaus E. Schauser, Chris J. ScheimanAbstract:In this paper we show how to extend the functionality of standard operating Systems completely at the user level. Our approach works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any re-linking or recompilation of existing applications. In fact, the extensions can even be dynamically "installed" into already running Processes. The extensions work completely at the user level and install without System administrator assistance. We used this approach to implement a global File System, called Ufo, which allows users to treat remote Files exactly as if they were local. Currently, Ufo supports File access through the FTP and HTTP protocols and allows new protocols to be plugged in. While several other projects have implemented global File System abstractions, they all require either changes to the operating System or modifications to standard libraries. The paper gives a detailed performance analysis of our approach to extending the OS and establishes that Ufo introduces acceptable overhead for common applications even though intercepting System calls incurs a high cost.
Klaus E. Schauser - One of the best experts on this subject based on the ideXlab platform.
-
User-level operating System extensions based on System call interposition
1999Co-Authors: Albert Alexandrov, Klaus E. SchauserAbstract:Extensibility is becoming a very important issue in modern operating Systems. Extensible operating Systems can easily adapt to satisfy the requirements of new emerging applications. Although a lot of research has gone into designing extensible operating Systems, existing standard operating Systems are difficult to extend. In this dissertation we show how to extend standard operating Systems completely at the user level without actual modifications to the operating System itself. Our approach is based on System call interposition. It works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any re-linking or re-compilation of existing applications. In fact, the extensions can even be dynamically “installed” into already running Processes. The extensions work completely at the user level and install without System administrator assistance. Individual users can choose what extensions to run, in effect creating a personalized operating System view for themselves. We demonstrate the viability of our approach by implementing two significant operating System extensions: Ufo and Consh. Ufo is a global File System that provides transparent access to remote HTTP and FTP servers. Consh is a confined shell for protected execution that provides services needed for new Internet computing applications. Our detailed performance analysis of these extensions shows that while System call interposition incurs noticeable performance overhead on individual System calls, the overall overhead for complete applications is acceptable. Furthermore, we analyze the current implementation of the / Proc interface, identify the bottlenecks responsible for the overhead and propose minor changes to the operating System to overcome these bottlenecks. The changes are small enough to be easily incorporated in a future version of the operating System. We implement the changes in a current operating System and demonstrate the resulting improved performance in the Ufo extension.
-
UFO: a personal global File System based on user-level extensions to the operating System
ACM Transactions on Computer Systems, 1998Co-Authors: Albert Alexandrov, Maximilian Ibel, Klaus E. Schauser, Chris J. ScheimanAbstract:In this article we show how to extend a wide range of functionality of standard operation Systems completely at the user level. Our approach works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any relinking or recompilation of existing applications. In fact, the extensions can even be dynamically “installed” into already running Processes. The extensions work completely at the user level and install without System administrator assistance. Individual users can choose what extensions to run, in effect creating a personalized operating System view for themselves. We used this approach to implement a global File System, called Ufo, which allows users to treat remote Files exactly as if they were local. Currently, Ufo supports File access through the FTP and HTTP protocols and allows new protocols to be plugged in. While several other projects have implemented global File System abstractions, they all require either changes to the operating System or modifications to standard libraries. The article gives a detailed performance analysis of our approach to extending the OS and establishes that Ufo introduces acceptable overhead for common applications even though intercepting individual System calls incurs a high cost.
-
Extending the operating System at the user level: the Ufo global File System
1997Co-Authors: Albert Alexandrov, Maximilian Ibel, Klaus E. Schauser, Chris J. ScheimanAbstract:In this paper we show how to extend the functionality of standard operating Systems completely at the user level. Our approach works by intercepting selected System calls at the user level, using tracing facilities such as the /Proc File System provided by many Unix operating Systems. The behavior of some intercepted System calls is then modified to implement new functionality. This approach does not require any re-linking or recompilation of existing applications. In fact, the extensions can even be dynamically "installed" into already running Processes. The extensions work completely at the user level and install without System administrator assistance. We used this approach to implement a global File System, called Ufo, which allows users to treat remote Files exactly as if they were local. Currently, Ufo supports File access through the FTP and HTTP protocols and allows new protocols to be plugged in. While several other projects have implemented global File System abstractions, they all require either changes to the operating System or modifications to standard libraries. The paper gives a detailed performance analysis of our approach to extending the OS and establishes that Ufo introduces acceptable overhead for common applications even though intercepting System calls incurs a high cost.
Luca Massarelli - One of the best experts on this subject based on the ideXlab platform.
-
AndroDFA: Android Malware Classification Based on Resource Consumption
Information, 2020Co-Authors: Luca Massarelli, Leonardo Aniello, Leonardo Querzoni, Claudio Ciccotelli, Daniele Ucci, Roberto BaldoniAbstract:The vast majority of today’s mobile malware targets Android devices. An important task of malware analysis is the classification of malicious samples into known families. In this paper, we propose AndroDFA (DFA, detrended fluctuation analysis): an approach to Android malware family classification based on dynamic analysis of resource consumption metrics available from the Proc File System. These metrics can be easily measured during sample execution. From each malware, we extract features through detrended fluctuation analysis (DFA) and Pearson’s correlation, then a support vector machine is employed to classify malware into families. We provide an experimental evaluation based on malware samples from two datasets, namely Drebin and AMD. With the Drebin dataset, we obtained a classification accuracy of 82%, comparable with works from the state-of-the-art like DroidScribe. However, compared to DroidScribe, our approach is easier to reproduce because it is based on publicly available tools only, does not require any modification to the emulated environment or Android OS, and by design, can also be used on physical devices rather than exclusively on emulators. The latter is a key factor because modern mobile malware can detect the emulated environment and hide its malicious behavior. The experiments on the AMD dataset gave similar results, with an overall mean accuracy of 78%. Furthermore, we made the software we developed publicly available, to ease the reproducibility of our results.
-
Android Malware Family Classification Based on Resource Consumption over Time
arXiv: Cryptography and Security, 2017Co-Authors: Luca Massarelli, Leonardo Aniello, Leonardo Querzoni, Claudio Ciccotelli, Daniele Ucci, Roberto BaldoniAbstract:The vast majority of today's mobile malware targets Android devices. This has pushed the research effort in Android malware analysis in the last years. An important task of malware analysis is the classification of malware samples into known families. Static malware analysis is known to fall short against techniques that change static characteristics of the malware (e.g. code obfuscation), while dynamic analysis has proven effective against such techniques. To the best of our knowledge, the most notable work on Android malware family classification purely based on dynamic analysis is DroidScribe. With respect to DroidScribe, our approach is easier to reproduce. Our methodology only employs publicly available tools, does not require any modification to the emulated environment or Android OS, and can collect data from physical devices. The latter is a key factor, since modern mobile malware can detect the emulated environment and hide their malicious behavior. Our approach relies on resource consumption metrics available from the Proc File System. Features are extracted through detrended fluctuation analysis and correlation. Finally, a SVM is employed to classify malware into families. We provide an experimental evaluation on malware samples from the Drebin dataset, where we obtain a classification accuracy of 82%, proving that our methodology achieves an accuracy comparable to that of DroidScribe. Furthermore, we make the software we developed publicly available, to ease the reproducibility of our results.
-
MALWARE - Android malware family classification based on resource consumption over time
2017 12th International Conference on Malicious and Unwanted Software (MALWARE), 2017Co-Authors: Luca Massarelli, Leonardo Aniello, Leonardo Querzoni, Claudio Ciccotelli, Daniele Ucci, Roberto BaldoniAbstract:The vast majority of today's mobile malware targets Android devices. This has pushed the research effort in Android malware analysis in the last years. An important task of malware analysis is the classification of malware samples into known families. Static malware analysis is known to fall short against techniques that change static characteristics of the malware (e.g. code obfuscation), while dynamic analysis has proven effective against such techniques. To the best of our knowledge, the most notable work on Android malware family classification purely based on dynamic analysis is DroidScribe. With respect to DroidScribe, our approach is easier to reproduce. Our methodology only employs publicly available tools, does not require any modification to the emulated environment or Android OS, and can collect data from physical devices. The latter is a key factor, since modern mobile malware can detect the emulated environment and hide their malicious behaviour. Our approach relies on resource consumption metrics available from the Proc File System. Features are extracted through detrended fluctuation analysis and correlation. Finally, a SVM is employed to classify malware into families. We provide an experimental evaluation on malware samples from the Drebin dataset, where we obtain a classification accuracy of 82%c, proving that our methodology achieves an accuracy comparable to that of DroidScribe. Furthermore, we make the software we developed publicly available, to ease the reproducibility of our results.