Shadow attacks: Automatically evading system-call-behavior based malware detection

Journal in Computer Virology

Volumn 8, Issue 1-2, 2012, Pages 1-13

  Ma, Weiqin ^a   Duan, Pu ^a   Liu, Sanmin ^a   Gu, Guofei ^a   Liu, Jyh Charn ^a  

^a TEXAS A AND M UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BEHAVIOR-BASED; BEHAVIOR-BASED DETECTION; CODE OBFUSCATION; CURRENT GENERATION; DETECTION TECHNIQUE; MALICIOUS BEHAVIOR; MALWARE ANALYSIS; MALWARE DETECTION; MALWARES; MULTI CORE; POTENTIAL THREATS; PROTOTYPE TOOLS; SECURITY PROBLEMS; SOURCE CODES; SYSTEM-CALL SEQUENCE;

DETECTORS; HUMAN COMPUTER INTERACTION; MULTICORE PROGRAMMING;

COMPUTER CRIME;

EID: 84860630143     PISSN: 17729890     EISSN: 17729904     Source Type: Journal    
DOI: 10.1007/s11416-011-0157-5     Document Type: Article

References (34)

1. Martignoni, L., Stinson, E., Fredrikson, M., Jha, S., Mitchell, J. C.: A Layered Architecture for Detecting Malicious Behaviors. In: Proceedings of the 11th international Symposium on Recent Advances in intrusion Detection (RAID'08) (2008).
2. Lattner, C., Adve, V.: LLVM: A compilation framework for lifelong program analysis & transformation. In: Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04) (2004).
3. Christodorescu, M., Jha, S., Seshia, S., Song, D., Bryant, R.: Semantics-Aware Malware Detection. In: Proceedings of IEEE Symposium on Security and Privacy (2005).
4. Barford, P., Yagneswaran, V.: An Inside Look at Botnets. In: Advances in Information Security. Springer, Berlin (2006).
5. Wagner, D., Soto, P.: Mimicry attacks on host-based intrusion detection systems. In: Proceedings of the 9th ACM conference on Computer and communications security (CCS'02) (2002).
6. Filiol, E.: Formalisation and implementation aspects of k-ary (malicious) codes. J. Comput. Virol. 3(3), 75-86 (2007) (EICAR 2007 Best Academic Papers).
7. Harbour, N.: Stealth Secrets of the Malware Ninjas. https://www. blackhat.com/presentations/bh-usa-07/Harbour/Presentation/bhusa-07-harbour.pdf.
8. Kolbitsch, C., Comparetti, P.M., Kruegel, C., Kirda, E., Zhou, X., Wang, X.: Effective and Efficient Malware Detection at the End Host. In: Proceedings of 18th USENIX Security Symposium (2009).
9. Nomenumbra: Counter Behavior Based Malware Analysis, Hacking at Random. HAR (2009).
10. Aciiçmez, O., Koç, Ç.K., Seifert, J.: On the power of simple branch prediction analysis. In: Proceedings of the 2nd ACM Symposium on information, Computer and Communications Security (ASIACCS' 07) (2007).
11. Kernighan, B.W., Lin, S.: An efficient heuristic procedure for partition graphs. Bell Syst. Tech. J. 49, 291-307 (1970).
12. Christodorescu, M., Jha, S., Kruegel, C.: Mining specifications of malicious behavior. In: Proceedings of the 6th JointMeeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (2007).
13. Anubis. http://anubis.iseclab.org/.
14. Lamport, L.: Time, clocks, and the ordering of events in a distributed system. Commun. ACM 21(7), 558-565 (1978).
15. Jiang, X., Walters, A., Buchholz, F., Xu, D., Wang, Y.M., Spafford, E.H.: Provenance-Aware Tracing ofWorm Break-in and Contaminations: A Process Coloring Approach. In: Proceedings of 26th IEEE Int'lConf.Distributed Computing Systems (ICDCS'06) (2006).
16. Fletcher, T.: Sharing a File Descriptor Between Processes. http://www.qnx.com/developers/articles/article_913_1.html.
17. Yin, H., Song, D., Manuel, E., Kruegel, C., Kirda, E.: Panorama: Capturing system-wide information flowformalware detection and analysis. In: Proceedings of the 14th ACM Conferences on Computer and Communication Security (2007).
18. King, S.T., Chen, P.M.: Backtracking Intrusions. In: Proceedings of the 2003 Symposium on Operating Systems Principles, pp. 223-236 (2003).
19. Kirda, E., Kruegel, C., Banks, G., Vigna, G., Kemmerer, R.: Behavior- based Spyware Detection. In: Proceedings of the USENIX Security Symposium (2006).
20. Cohen, F.: Computer viruses: theory and experiments. Comput. Secur. 6(1), 22-35 (1987).
21. Phoenix. https://connect.microsoft.com/Phoenix.
22. Cavallaro, L., Saxena, P., Sekar, R.: On the limits of information flowtechniques for malware analysis and containment. In: Proceedings of 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment (2008).
23. Szor, P.: The Art of Computer Virus Research and Defense. Addison-Wesley Professional, Reading (2005).
24. Forrest, S., Perelson, A.S., Allen, L., Cherukuri, R., Self-Nonself Discrimination in a Computer. In: Proceedings of IEEE Symposium on Security & Privacy (1994).
25. Stinson, E., Mitchell, J.C.: Characterizing Bots' Remote Control Behavior. In: Detection of Intrusions&Malware, andVulnerability Assessment (2007).
26. Willems, C., Holz, T., Freiling, F.: Toward Automated Dynamic Malware Analysis Using CWSandbox. In: Proceedings of IEEE Security and Privacy (2007).
27. Kruegel, C., Kirda, E., Mutz, D., Robertson, W., Vigna, G.: Automating mimicry attacks using static binary analysis. In: Proceedings of the 14th conference on USENIX Security Symposium (2005).
28. Norman Sandbox Whitepaper. http://www.norman.com.
29. Srivastava, A., Lanzi, A., Giffin, J.: System Call API Obfuscation. In: Proceedings of the 11th International Symposium on Recent Advances in Intrusion Detection (2008).
30. Rieck, K., Holz, T., Willems, C., Düssel, P., Laskov, P.: Learning and Classification of Malware Behavior. In: Proceedings of Detection of Intrusions and Malware, and Vulnerability Assessment (2008).
31. Percival, C.: Cache missing for fun and profit. BSDCan (2005). http://www.daemonology.net/hyperthreading-consideredharmful/.
32. Stevens, R.: UNIX Network Programming, 2nd edn. Interprocess Communications, vol. 2. Prentice Hall, Englewood Cliffs (1999).
33. Dyshlevoi, K.V., Kamensky, V.E., Solovskaya, L.B.: Marshalling In Distributed Systems: Two Approaches (1997). http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.26.9781.
34. Borello, J., Mé, L.: Code obfuscation techniques for metamorphic viruses. J. Comput.Virol. 4, 211-220 (2008). doi:10.1007/s11416-008-0084-2.