90 likes | 168 Views
A Methodology for Malware Evaluation. Student: Hsun -Yi Tsai Advisor: Dr. Kuo -Chen Wang National Chiao Tung University. Outline. Introduction Background Problem Statement Prototype Conclusion References. Introduction.
E N D
A Methodology for Malware Evaluation Student: Hsun-Yi Tsai Advisor: Dr. Kuo-Chen Wang National Chiao Tung University
Outline Introduction Background Problem Statement Prototype Conclusion References
Introduction • In recent years, malware has been severe threats to the cyber security • Virus, Worms, Trojan horse, Bot … • Anti-Virus • Zero day malware might result in false negative • Behavior analysis might result in false positive • Propose an algorithm for malware evaluation
Background • Sandbox • Virtual machine • Records every single behavior the malware made
Problem Statement • Given • Several sandbox • m known malwares Mj= {M1,M2, …, Mm} • l anti-virus software AVi= {AV1, AV2, …, AVl} • Objective • n rules Rk= {R1,R2, …, Rn} • n coefficients Ak= {A1,A2, …, An} • A1R1 + A2R2 + … +AnRn
Conclusion Propose an evaluating algorithm for malware samples The rules used in the algorithm could be added to the behavior analysis portion of toolchain
References [1] Bayer, U., MilaniComparetti, P., Hlauschek, C., Krugel, C.,andKirda, E. 2009. Scalable, Behavior-Based Malware Clustering. In 16th Annual Network and Distributed System Security Symposium (NDSS09) [2] Lee, T. and Mody, J. J. 2006. Behavioral Classification . In European Institute for Computer Antivirus Research Conference (EICAR) [3] Moser, A., Kruegel, C., and Kirda, E. 2007. Exploring Multiple Execution Paths for Malware Analysis. In IEEE Symposium on Security and Privacy, Oakland. [4] Norman Sandbox 2003. Norman SandBox Whitepaper. http://download.norman.no/whitepaper/whitepaper_Norman_SandBox.pdf [5] Rieck, K., Holz, T., Willems, C., Dussel, P., and Laskov, P. 2008. Learning and Classification of Malawre Behavior. In Detection of Intrusions and Malware, and Vulnerability Assessment, 5th International Conference (DIMVA). 108-125 [6] Willems, C., Holz, T., and Freiling, F. 2007. Toward Automated Dynamic Malware Analysis Using CWSandbox. IEEE Security and Privacy 5, 2, 32-39 [7] A. Acharya, M. Raje. 1999. MAPbox: Using Parameterized Behavior Classes to Confine Applications. University of California at Santa Barbara Santa Barbara, CA, USA [8] Jana, S., Porter, D.E., Shmatikov, V. 2011. TxBox: Building Secure, Efficient Sandboxes with System Transactions. In IEEE Security and Privacy (SP) Symposium. [9] GFI Sandbox. http://www.gfi.com/malware-analysis-tool