Analysis and Detection of Heap-based Malwares Using Introspection in a Virtualized Environment
نویسندگان
چکیده
Malware detection and analysis is a major part of computer security. There is an arm race between security experts and malware developers to develop various techniques to secure computer systems and to nd ways to circumvent these security methods. In recent years process heap-based attacks have increased signi cantly. These attacks exploit the system under attack via the heap, typically by using a heap spraying attack. The main drawback with existing techniques is that they either consume too many resources or are complicated to implement. Our work in this thesis focuses on new methods which o oads process heap analysis for guest Virtual Machines (VM) to the privileged domain using Virtual Machine Introspection (VMI) in a Cloud environment. VMI provides us with a seamless, non-intrusive and invisible (to malwares) way of observing the memory and state of VMs without raising red ags for the malwares.
منابع مشابه
Atomizer: Fast, Scalable and Lightweight Heap Analyzer for Virtual Machines in a Cloud Environment
In recent years process heap-based attacks have increased significantly. These attacks exploit the system under attack via the heap, typically by using a heap spraying attack. A large number of malicious files and URLs offering dangerous contents are potentially encountered every day, both by client-side and server-side applications. Static and dynamic methods have been proposed to detect heap-...
متن کاملDesign and Implementation of an Isolated Sandbox with Mimetic Internet Used to Analyze Malwares
Recent viruses, worms, and bots, called malwares, often have anti-analysis functions such as mechanisms that confirm connectivity to certain Internet hosts and detect virtualized environments. We discuss how malwares can be kept alive in an analyzing environment by disabling their anti-analyzing mechanisms. To avoid any impacts to/from the Internet, we conclude that analyzing environments shoul...
متن کاملDyVSoR: dynamic malware detection based on extracting patterns from value sets of registers
To control the exponential growth of malware files, security analysts pursue dynamic approaches that automatically identify and analyze malicious software samples. Obfuscation and polymorphism employed by malwares make it difficult for signature-based systems to detect sophisticated malware files. The dynamic analysis or run-time behavior provides a better technique to identify the threat. In t...
متن کاملVirtual Machine Introspection Based Malware Behavior Profiling and Family Grouping
The proliferation of malwares have been attributed to the alternations of the original malware source codes. The malwares alternated from the same origin share some intrinsic behaviors and form a malware family. Expediently, identifying its malware family when a malware is first seen can provide useful clues to mitigating the threat. In this paper, a malware profiler (VMP) is proposed to profil...
متن کاملEffects of Pregnant Leach Solution Temperature on the Permeability of Gravelly Drainage Layer of Heap Leaching Structures
In copper heap leaching structures, the ore is leached by an acidic solution. After dissolving the ore mineral, the heap is drained off in the acidic solution using a drainage system (consisting of a network of perforated polyethylene pipes and gravelly drainage layers) and is, then, transferred to the leaching plant for copper extraction where the copper is extracted and the remaining solution...
متن کامل