malware behavioral detection by attribute automata using
play

Malware Behavioral Detection by Attribute-Automata using - PowerPoint PPT Presentation

Oct 29, 2022 •110 likes •327 views

Malware Behavioral Detection by Attribute-Automata using Abstraction from Platform and Language JACOB Grgoire 1/2 , DEBAR Herv 1 , FILIOL Eric 2 1 Orange Labs / France Tlcom R&D, Security and Trusted Transactions (MAPS/STT). 2

  1. Malware Behavioral Detection by Attribute-Automata using Abstraction from Platform and Language JACOB Grégoire 1/2 , DEBAR Hervé 1² , FILIOL Eric 2 1 Orange Labs / France Télécom R&D, Security and Trusted Transactions (MAPS/STT). 2 ESIEA, Cryptology & Virology Lab. 12 th RAID Symposium September 2009 Cryptology & Virology Lab. Research & Development

  2. 1. Outline Context � Interest of behavioral detection against unknown malware Theoretically detects, if not innovative malware, at least variants reusing known techniques � In AV products, behavioral detectors still rely on too specific characteristics Escape through simple functional modifications (variants multiplication) Problematics � Can we describe malicious behaviors generically ? � Can we address the semantic gap between the model and data collection ? � Can we detect accurately these descriptions in a reasonable time ? September 2009/G. Jacob – p 2 Orange Labs/ESIEA research & development

  3. 1. Outline Increasing expressiveness of behavioral models � 1995 – Simple Finite State Automata [B. L. Charlier et al.] • Alternative sequences of operations � 2005 – Information flow analysis [J. Newsome et al., S. Bhatkar et al.] • Operations involving misapropriate data flow � 2007 – Graphs with data dependencies [M. Christodorescu et al., L. Martignoni et al., J. Morales et al.] • Sequences of operations with data dependencies September 2009/G. Jacob – p 3 Orange Labs/ESIEA research & development

  4. Summary 1 � Outline 2 � Behavioral descriptions based on attribute-grammars � Abstract Malicious Behavior Language � Describing duplication 3 � Detection by attribute-automata � Layered architecture � Abstraction layer for translation � Detection layer by attribute-automata � Prototyping 4 � Coverage and performance evaluation � Detection and errors rates � Performance 5 � Considerations and perspectives September 2009/G. Jacob – p 4 Orange Labs/ESIEA research & development

  5. 2 Behavioral Descriptions based on Attribute-Grammars September 2009/G. Jacob – p 5 Orange Labs/ESIEA research & development

  6. 2. 1 Abstract Malicious Behavior Language Object-oriented principles � Internal operations (Turing complete) � Interactions to interface with external objects � Grammar: syntax and operational semantics for operations and interactions Malware encapsulation Above semantic rules � Object binding using identifiers - Constraints on the data-flow � Object typing Type partially ordered set - Reveals the purpose of objects in the malware lifecycle e.g. Purpose Type Persistence Permanent objects Propagation Communicating objects Residency Booting objects September 2009/G. Jacob – p 6 Orange Labs/ESIEA research & development

  7. 2. 2 Describing Duplication Duplication � Duplication principle: Copying data from the Object typing self-reference towards a permanent object Object binding � Syntactic productions convey different technical solutions: -Single block read/write -Interleaved read/write -Direct copy -Possible permutations � Propagation differs in typing: Communicating object as target September 2009/G. Jacob – p 7 Orange Labs/ESIEA research & development

  8. 3 Detection by Attribute-Automata September 2009/G. Jacob – p 8 Orange Labs/ESIEA research & development

  9. 3. 1 Layered Architecture Global architecture in separate layers � Collection mechanisms: recovers execution traces � Abstraction layer: translates collected traces into the behavioral model � Detection by parallel attribute-automata: parses behavior descriptions � Configuration process: new objects, languages, or behaviors September 2009/G. Jacob – p 9 Orange Labs/ESIEA research & development

  10. 3. 2 Abstraction Layer for Translation Translating operations and interactions � Translation is specific to a given language � Translation by mapping for arithmetic and control operations � Translation by mapping from API calls over interactions September 2009/G. Jacob – p 10 Orange Labs/ESIEA research & development

  11. 3. 2 Abstraction Layer for Translation Translating external objects � Translation affects to objects a unique identifier and a type � Specific to a platform and its applicative configuration � Deployed by decision trees depending on the object representation: constants, addresses and handles, character strings � Tree generation by identification of vulnerable objects at three levels: hardware, operating system, applications (connected and widely deployed) September 2009/G. Jacob – p 11 Orange Labs/ESIEA research & development

  12. 3. 3 Detection Layer by Attribute-Automata Algorithm properties � Translated events in input � Each event feeds the parallel automata for progression in the derivations � Each automaton manage several derivations: parallel derivations corresponds to different behavior instances Derivations (Current State, Parsing Stack, Semantic Stack) Events (Inteaction/Operation, Semantic values) Automata September 2009/G. Jacob – p 12 Orange Labs/ESIEA research & development

  13. 3. 3 Detection Layer by Attribute-Automata Algorithm properties � Semantic routines check prerequisites and evaluate consequences: match collected semantic values with computed ones or computes new values from existing ones � Irrelevant events are discarded � Potentially ambiguous events duplicate derivations: Ambiguous = related to the behavior but making derivation fail open this open file1 open file2 read this Duplication Recognized Start Duplication Duplicate open file2 write file2 Derivation Derivation September 2009/G. Jacob – p 13 Orange Labs/ESIEA research & development

  14. 3. 4 Prototyping Prototype global architecture � Two abstraction components for PE traces and VBS Scripts: log analysis for PE dynamic traces and path exploration for VBS scripts � Four detection automata: duplication, propagation, residency and overinfection tests September 2009/G. Jacob – p 14 Orange Labs/ESIEA research & development

  15. 4 Coverage and Performance Evaluation September 2009/G. Jacob – p 15 Orange Labs/ESIEA research & development

  16. 4. 1 Detection and Error Rates Detection rates by behavior PE Detection Rates EmW = Email-Worms, P2PW = P2P-Worms, FN NtW = Network Worms, V = Virii, Trj = Trojans TP VBS Detection Rates EmW = Email-Worms, FdW = Flashdrive-Worms, IrcW = Irc-Worms, V = Virii, P2PW = P2P-Worms, Gen = Malware Generators FN TP September 2009/G. Jacob – p 16 Orange Labs/ESIEA research & development

  17. 4. 1 Detection and Error Rates False negatives � Limitations in the dynamic collection mechanisms (PE Traces Anlayzer) • Simulation software configuration: 64% of missed Virii did not execute properly • Simulation network configuration: 75% of Email-Worms did not show SMTP activity • Collection level impacting the data-flow: 10% of Virii and Email-Worms missed because of intermediate operations in memory (mutation, base64 encoding) � Limitations in the static collection mechanisms (VBS Script Anlayzer) • Body ciphering: only string ciphering supported yet • Cohabitation with other languages: failure of the syntactic analysis � Irrelevances in the behavioral model • Too much specific descriptions: only 2% of Overinfection tests detected False positives for legitimate samples � A single false positive for residency in more than a hundred samples • No real false-positive: malware cleaner restarting the browser start page September 2009/G. Jacob – p 17 Orange Labs/ESIEA research & development

  18. 4. 2 Performance Material performance (Dual Core 2,6GHz) � PE Traces Analyzer: 0,340s/log � VB Script Analyzer: 0,016s/log � Detection Automata: 0,440s/log (PE) 0,001s/log (VBS) Detection complexity � Important theoretical complexity in worst case scenario � Reasonable operational complexity in function of the ambiguity ratio α � An important α is already a sign of malicious activity Complexity Value Worst Case Best Case Operational September 2009/G. Jacob – p 18 Orange Labs/ESIEA research & development

  19. 5 Considerations and Perspectives September 2009/G. Jacob – p 19 Orange Labs/ESIEA research & development

  20. 5. Considerations and perspectives Contributions � Generic, synthetic and human understandable behavioral signatures � Proofs of concept for the detection automata and two abstraction components analyzing PE traces and VBS scripts � Experimentations showing promising detection rates and reasonable performances Perspectives � Increase the detection coverage by using sophisticated collection tools: tainting tools to avoid breakdowns in the data flow � Profiling malware categories according to their behaviors September 2009/G. Jacob – p 20 Orange Labs/ESIEA research & development

  21. Thank you for your attention, Any questions? September 2009/G. Jacob – p 21 Orange Labs/ESIEA research & development

Recommend

Behavioral Detection and Containment of Proximity Malware in Delay Tolerant Networks Wei Peng,

Behavioral Detection and Containment of Proximity Malware in Delay Tolerant Networks Wei Peng,

Behavioral Detection and Containment of Proximity Malware in Delay Tolerant Networks Wei Peng, Feng Li, Xukai Zou, and Jie Wu 1 / 47 Proximity malware Definition. Proximity malware is a malicious program which propagates

618 views • 47 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
MALWARE DETECTION BY EATING A WHOLE EXE Presented by: Edward Raff Jared Sylvester Robert

MALWARE DETECTION BY EATING A WHOLE EXE Presented by: Edward Raff Jared Sylvester Robert

MALWARE DETECTION BY EATING A WHOLE EXE Presented by: Edward Raff Jared Sylvester Robert Brandon 1 November 2017 2 Malware Detection? Dont AVs do that? Single incidents of malware are now causing millions in damages. Potential

347 views • 19 slides
AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses

AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses

VIRUSES, WORMS, AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses Intrusion detection Behavioral detection Firewalls Virus/antivirus Application firewalls coevolution paper discussed

915 views • 56 slides
D&D of malware with exotic C&C D&D = Description & Detection C&C = Command

D&D of malware with exotic C&C D&D = Description & Detection C&C = Command

D&D of malware with exotic C&C D&D = Description & Detection C&C = Command & Control Automotive Consumer Energy & Chemicals Paul Rascagneres - @r00tbsd Eric Leblond - @Regiteric D&D of malware with exotic C&C

781 views • 34 slides
VIRUSES AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses

VIRUSES AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses

VIRUSES AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses Intrusion detection Behavioral detection Firewalls Virus/antivirus Application firewalls coevolution paper discussed

551 views • 40 slides
Experiences of of La Landing Machine Le Learning onto Market-Scale Mobile Malware Detection

Experiences of of La Landing Machine Le Learning onto Market-Scale Mobile Malware Detection

Experiences of of La Landing Machine Le Learning onto Market-Scale Mobile Malware Detection Liangyi Gong, Zhenhua Li, Feng Qian, Zifan Zhang, Qi Alfred Chen, Zhiyun Qian, Hao Lin, Yunhao Liu Mobile Malware Detection Android App Markets

424 views • 29 slides
Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network

Behavioral Clustering of HTTP-based Malware and Signature Generation using Malicious Network Traces Roberto Perdisci (1,2) , Wenke Lee (1,2) , Nick Feamster (1) (1) (2) USENIX NSDI 2010 Malware = Malicious Software Most modern cyber

601 views • 31 slides
Efficient Malware Detection using Model-Checking Tayssir Touili LIPN, CNRS & Univ. Paris 13

Efficient Malware Detection using Model-Checking Tayssir Touili LIPN, CNRS & Univ. Paris 13

Efficient Malware Detection using Model-Checking Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of

1.04k views • 52 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Analyzing Malware Detection Effectiveness with Multiple Anti- Malware Programs Jose A. Morales

Analyzing Malware Detection Effectiveness with Multiple Anti- Malware Programs Jose A. Morales

Analyzing Malware Detection Effectiveness with Multiple Anti- Malware Programs Jose A. Morales Shouhuai Xu Ravi Sandhu SEI @ CMU CS @ UTSA ICS @ UTSA Roadmap Motivation Experimental Methodology Experimental Results Summary

560 views • 16 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al

Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al

Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al [FSE 14] Presented by Maaz Ahmad The Malware Problem (Feb, 2015) Motive Security Labs estimates 16 million infected mobile devices. [1]

828 views • 30 slides
Netgator: Malware Detection Using Program Interactive Challenges Brian Schulte, Haris

Netgator: Malware Detection Using Program Interactive Challenges Brian Schulte, Haris

Netgator: Malware Detection Using Program Interactive Challenges Brian Schulte, Haris Andrianakis, Kun Sun, and Angelos Stavrou Intro Increase of stealthy malware in enterprises Obfuscation, polymorphic techniques Often uses

766 views • 25 slides
Outline Intrusion detection systems Malware and the network CSci 5271 Announcements

Outline Intrusion detection systems Malware and the network CSci 5271 Announcements

Outline Intrusion detection systems Malware and the network CSci 5271 Announcements intermission Introduction to Computer Security Middlebox, malware, anonymity combined slides Denial of service and the network Anonymous communications

253 views • 11 slides
Problems and methods for attribute detection of social network users Anton Korshunov Institute

Problems and methods for attribute detection of social network users Anton Korshunov Institute

Problems and methods for attribute detection of social network users Anton Korshunov Institute for System Programming of Russian Academy of Sciences RCDL-2013 Contents Network Level: User Community Detection 1 User Level: Demographic

628 views • 41 slides
Detecting the behavioral relationships of malware connections (slides) Conference Paper August

Detecting the behavioral relationships of malware connections (slides) Conference Paper August

See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/307638742 Detecting the behavioral relationships of malware connections (slides) Conference Paper August 2016 CITATIONS READS 0

380 views • 17 slides
Alpha Presentation Next Generation Malware Detection, Clustering and Heuristics The Capstone

Alpha Presentation Next Generation Malware Detection, Clustering and Heuristics The Capstone

Alpha Presentation Next Generation Malware Detection, Clustering and Heuristics The Capstone Experience Team Proofpoint George Zhao Yash Patel Graham Thomas Brad Doherty Crystal Lewis Department of Computer Science and Engineering

761 views • 10 slides
Project Plan Next Generation Malware Detection, Clustering and Heuristics The Capstone

Project Plan Next Generation Malware Detection, Clustering and Heuristics The Capstone

Project Plan Next Generation Malware Detection, Clustering and Heuristics The Capstone Experience Team Proofpoint Crystal Lewis Yash Patel George Zhao Graham Thomas Brad Doherty Department of Computer Science and Engineering Michigan

402 views • 11 slides
Attacks Meet Interpretability: Attribute-steered Detection of Adversarial Samples Guanhong Tao ,

Attacks Meet Interpretability: Attribute-steered Detection of Adversarial Samples Guanhong Tao ,

Attacks Meet Interpretability: Attribute-steered Detection of Adversarial Samples Guanhong Tao , Shiqing Ma, Yingqi Liu, Xiangyu Zhang Understanding Adversarial Samples Legitimate input Isla Fisher Model Pixel-wise Differences ( 50 times)

482 views • 34 slides
Outline Intrusion detection systems CSci 5271 Malware and the network Introduction to Computer

Outline Intrusion detection systems CSci 5271 Malware and the network Introduction to Computer

Outline Intrusion detection systems CSci 5271 Malware and the network Introduction to Computer Security Announcements intermission Day 22: Malware and Denial of Service Stephen McCamant Denial of service and the network University of

684 views • 10 slides
Anomaly Detection Algorithms for Malware Traffic Analysis using Tamper Resistant Features Dr.

Anomaly Detection Algorithms for Malware Traffic Analysis using Tamper Resistant Features Dr.

Anomaly Detection Algorithms for Malware Traffic Analysis using Tamper Resistant Features Dr. Patrick McDaniel Berkay Celik Fall 2015 Introduction Motivation Related Work Data Approach Experimental Results Comparison

391 views • 25 slides
MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico

MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models Enrico Mariconti , Lucky Onwuzurike, Panagiotis Andriotis, Emiliano De Cristofaro, Gordon Ross, Gianluca Stringhini. NDSS 2017, 28-02-2017 Motivation: Android

1.21k views • 37 slides

More recommend