The Experts below are selected from a list of 159 Experts worldwide ranked by ideXlab platform

Camil Demetrescu - One of the best experts on this subject based on the ideXlab platform.

  • CSCML - Reconstructing C2 Servers for remote access trojans with Symbolic Execution.
    Lecture Notes in Computer Science, 2019
    Co-Authors: Luca Borzacchiello, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    The analysis of a malicious piece of software that involves a remote counterpart that instructs it can be troublesome for security professionals, as they may have to unravel the communication protocol in use to figure out what actions can be carried out on the victim’s machine. The possibility to recur to dynamic analysis hinges on the availability of an active remote counterpart, a requirement that may be difficult to meet in several scenarios. In this paper we explore how symbolic execution techniques can be used to synthesize a command-and-control server for a remote access trojan, enabling in-vivo analysis by malware analysts. We evaluate our ideas against two real-world malware instances.

  • CSCML - Assisting Malware Analysis with Symbolic Execution: A Case Study
    Lecture Notes in Computer Science, 2017
    Co-Authors: Roberto Baldoni, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    Security analysts spend days or even weeks in trying to understand the inner workings of malicious software, using a plethora of manually orchestrated tools. Devising automated tools and techniques to assist and speed up the analysis process remains a major endeavor in computer security. While manual intervention will likely remain a key ingredient in the short and mid term, the recent advances in static and dynamic analysis techniques have the potential to significantly impact the malware analysis practice. In this paper we show how an analyst can use symbolic execution techniques to unveil critical behavior of a remote access trojan (RAT). Using a tool we implemented in the Angr framework, we analyze a sample drawn from a well-known RAT family that leverages thread injection vulnerabilities in the Microsoft Win32 API. Our case study shows how to automatically derive the list of commands supported by the RAT and the sequence of system calls that are activated for each of them, systematically exploring the stealthy communication protocol with the server and yielding clues to potential threats that may pass unnoticed by a manual inspection.

Kazumasa Omote - One of the best experts on this subject based on the ideXlab platform.

  • Inscrypt - Early Detection of remote access trojan by Software Network Behavior
    Information Security and Cryptology, 2019
    Co-Authors: Masatsugu Oya, Kazumasa Omote
    Abstract:

    APT (Advanced Persistent Threat) attack is increasing in recent years. APT attackers usually utilize malware called RAT (remote access trojan) to access and control computers by stealth. The invasion method of RAT has been refined and it is extremely difficult to prevent its infection beforehand. Hence, an approach to detect RAT infection at the early stage after infection is important. However, there are two drawbacks in the existing early detection methods of RAT; (1) they do not become early detection in some circumstances; (2) they do not consider the RAT-like healthy software (e.g., system related software and antivirus software) for evaluation experiments. In this paper, we propose a detection method of RAT based on the new mechanism of early detection. Our evaluation experiments show that the proposed method can distinguish between RAT and the RAT-like healthy software with great accuracy.

  • early detection of remote access trojan by software network behavior
    International Conference on Information Security and Cryptology, 2018
    Co-Authors: Masatsugu Oya, Kazumasa Omote
    Abstract:

    APT (Advanced Persistent Threat) attack is increasing in recent years. APT attackers usually utilize malware called RAT (remote access trojan) to access and control computers by stealth. The invasion method of RAT has been refined and it is extremely difficult to prevent its infection beforehand. Hence, an approach to detect RAT infection at the early stage after infection is important. However, there are two drawbacks in the existing early detection methods of RAT; (1) they do not become early detection in some circumstances; (2) they do not consider the RAT-like healthy software (e.g., system related software and antivirus software) for evaluation experiments. In this paper, we propose a detection method of RAT based on the new mechanism of early detection. Our evaluation experiments show that the proposed method can distinguish between RAT and the RAT-like healthy software with great accuracy.

  • a host based detection method of remote access trojan in the early stage
    International Conference on Information Security, 2016
    Co-Authors: Daichi Adachi, Kazumasa Omote
    Abstract:

    The attacks called Advanced Persistent Threat (APT) attack targeting a specific organization are increasing. APT attack usually uses malware called remote access trojan (RAT) which can steal the confidential information from a target organization. Although there are many existing approaches about RAT detection, there still remain two challenges: to detect RATs as early as possible, and to distinguish them from the normal applications with high accuracy and low FNR.

  • ISPEC - A Host-Based Detection Method of remote access trojan in the Early Stage
    Information Security Practice and Experience, 2016
    Co-Authors: Daichi Adachi, Kazumasa Omote
    Abstract:

    The attacks called Advanced Persistent Threat (APT) attack targeting a specific organization are increasing. APT attack usually uses malware called remote access trojan (RAT) which can steal the confidential information from a target organization. Although there are many existing approaches about RAT detection, there still remain two challenges: to detect RATs as early as possible, and to distinguish them from the normal applications with high accuracy and low FNR.

  • an approach to detect remote access trojan in the early stage of communication
    Advanced Information Networking and Applications, 2015
    Co-Authors: Dan Jiang, Kazumasa Omote
    Abstract:

    As data leakage accidents occur every year, the security of confidential information is becoming increasingly important. remote access trojans (RAT), a kind of spyware, are used to invade the PC of a victim through targeted attacks. After the intrusion, the attacker can monitor and control the victim's PC remotely, to wait for an opportunity to steal the confidential information. Since it is hard to prevent the intrusion of RATs completely, preventing confidential information being leaked back to the attacker is the main issue. Various existing approaches introduce different network behaviors of RAT to construct detection systems. Unfortunately, two challenges remain: one is to detect RAT sessions as early as possible, the other is to remain a high accuracy to detect RAT sessions, while there exist normal applications whose traffic behave similarly to RATs. In this paper, we propose a novel approach to detect RAT sessions in the early stage of communication. To differentiate network behaviors between normal applications and RAT, we extract the features from the traffic of a short period of time at the beginning. Afterward, we use machine learning techniques to train the detection model, then evaluate it by K-Fold cross-validation. The results show that our approach is able to detect RAT sessions with a high accuracy. In particular, our approach achieves over 96% accuracy together with the FNR of 10% by Random Forest algorithm, which means that our approach is valid to detect RAT sessions in the early stage of communication.

Emilio Coppa - One of the best experts on this subject based on the ideXlab platform.

  • CSCML - Reconstructing C2 Servers for remote access trojans with Symbolic Execution.
    Lecture Notes in Computer Science, 2019
    Co-Authors: Luca Borzacchiello, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    The analysis of a malicious piece of software that involves a remote counterpart that instructs it can be troublesome for security professionals, as they may have to unravel the communication protocol in use to figure out what actions can be carried out on the victim’s machine. The possibility to recur to dynamic analysis hinges on the availability of an active remote counterpart, a requirement that may be difficult to meet in several scenarios. In this paper we explore how symbolic execution techniques can be used to synthesize a command-and-control server for a remote access trojan, enabling in-vivo analysis by malware analysts. We evaluate our ideas against two real-world malware instances.

  • CSCML - Assisting Malware Analysis with Symbolic Execution: A Case Study
    Lecture Notes in Computer Science, 2017
    Co-Authors: Roberto Baldoni, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    Security analysts spend days or even weeks in trying to understand the inner workings of malicious software, using a plethora of manually orchestrated tools. Devising automated tools and techniques to assist and speed up the analysis process remains a major endeavor in computer security. While manual intervention will likely remain a key ingredient in the short and mid term, the recent advances in static and dynamic analysis techniques have the potential to significantly impact the malware analysis practice. In this paper we show how an analyst can use symbolic execution techniques to unveil critical behavior of a remote access trojan (RAT). Using a tool we implemented in the Angr framework, we analyze a sample drawn from a well-known RAT family that leverages thread injection vulnerabilities in the Microsoft Win32 API. Our case study shows how to automatically derive the list of commands supported by the RAT and the sequence of system calls that are activated for each of them, systematically exploring the stealthy communication protocol with the server and yielding clues to potential threats that may pass unnoticed by a manual inspection.

Daniele Cono D'elia - One of the best experts on this subject based on the ideXlab platform.

  • CSCML - Reconstructing C2 Servers for remote access trojans with Symbolic Execution.
    Lecture Notes in Computer Science, 2019
    Co-Authors: Luca Borzacchiello, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    The analysis of a malicious piece of software that involves a remote counterpart that instructs it can be troublesome for security professionals, as they may have to unravel the communication protocol in use to figure out what actions can be carried out on the victim’s machine. The possibility to recur to dynamic analysis hinges on the availability of an active remote counterpart, a requirement that may be difficult to meet in several scenarios. In this paper we explore how symbolic execution techniques can be used to synthesize a command-and-control server for a remote access trojan, enabling in-vivo analysis by malware analysts. We evaluate our ideas against two real-world malware instances.

  • CSCML - Assisting Malware Analysis with Symbolic Execution: A Case Study
    Lecture Notes in Computer Science, 2017
    Co-Authors: Roberto Baldoni, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    Security analysts spend days or even weeks in trying to understand the inner workings of malicious software, using a plethora of manually orchestrated tools. Devising automated tools and techniques to assist and speed up the analysis process remains a major endeavor in computer security. While manual intervention will likely remain a key ingredient in the short and mid term, the recent advances in static and dynamic analysis techniques have the potential to significantly impact the malware analysis practice. In this paper we show how an analyst can use symbolic execution techniques to unveil critical behavior of a remote access trojan (RAT). Using a tool we implemented in the Angr framework, we analyze a sample drawn from a well-known RAT family that leverages thread injection vulnerabilities in the Microsoft Win32 API. Our case study shows how to automatically derive the list of commands supported by the RAT and the sequence of system calls that are activated for each of them, systematically exploring the stealthy communication protocol with the server and yielding clues to potential threats that may pass unnoticed by a manual inspection.

Luca Borzacchiello - One of the best experts on this subject based on the ideXlab platform.

  • CSCML - Reconstructing C2 Servers for remote access trojans with Symbolic Execution.
    Lecture Notes in Computer Science, 2019
    Co-Authors: Luca Borzacchiello, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu
    Abstract:

    The analysis of a malicious piece of software that involves a remote counterpart that instructs it can be troublesome for security professionals, as they may have to unravel the communication protocol in use to figure out what actions can be carried out on the victim’s machine. The possibility to recur to dynamic analysis hinges on the availability of an active remote counterpart, a requirement that may be difficult to meet in several scenarios. In this paper we explore how symbolic execution techniques can be used to synthesize a command-and-control server for a remote access trojan, enabling in-vivo analysis by malware analysts. We evaluate our ideas against two real-world malware instances.