TrumanBox: Improving Dynamic Malware Analysis by Emulating the Internet
نویسندگان
چکیده
Dynamic analysis of malicious software (malware) is a powerful tool in countering modern threats on the Internet. In dynamic analysis, a malware sample is executed in a controlled environment and its actions are logged. Through dynamic analysis, an analyst can quickly obtain an overview of malware behavior and can decide whether or not to indulge into tedious manual analysis of the sample. However, usual dynamic analysis exposes the Internet to the threats of an executed malware (like portscans) because advanced concealment techniques of malware often require full Internet access. For example, a missing link to the Internet or the unavailability of a specific server often causes the malware to not trigger its malicious behavior. In this paper, we present TRUMANBOX, a technique to emulate relevant parts of the Internet to enhance dynamic malware analysis. We show that TRUMANBOX not only prevents many threats but also enlarges the scope of the types of malware that can be analyzed dynamically.
منابع مشابه
DyVSoR: dynamic malware detection based on extracting patterns from value sets of registers
To control the exponential growth of malware files, security analysts pursue dynamic approaches that automatically identify and analyze malicious software samples. Obfuscation and polymorphism employed by malwares make it difficult for signature-based systems to detect sophisticated malware files. The dynamic analysis or run-time behavior provides a better technique to identify the threat. In t...
متن کاملLASETER AND ERIC JOHNSON A Better Way to
A Better Way to Battle Malware Emulating the methods used to transform production quality could clean up the Internet — and might even pay for itself.
متن کاملSecure and transparent network traffic replay, redirect, and relay in a dynamic malware analysis environment
Dynamic analysis is typically performed in a closed network environment to prevent the malware under analysis from attacking machines on the Internet. However, many of today’s malwares require Internet connectivity to operate and to be thoroughly analyzed in a closed network environment. We propose a secure and transparent network environment that allows the malware in a dynamic analysis enviro...
متن کاملAttack and Defense of Dynamic Analysis-Based, Adversarial Neural Malware Classification Models
Recently researchers have proposed using deep learning-based systems for malware detection. Unfortunately, all deep learning classification systems are vulnerable to adversarial attacks where miscreants can avoid detection by the classification algorithm with very few perturbations of the input data. Previous work has studied adversarial attacks against static analysisbased malware classifiers ...
متن کاملAutomated Malware Analysis System and Its Sandbox for Revealing Malware's Internal and External Activities
Malware has been recognized as one of the major security threats in the Internet. Previous researches have mainly focused on malware’s internal activity in a system. However, it is crucial that the malware analysis extracts a malware’s external activity toward the network to correlate with a security incident. We propose a novel way to analyze malware: focus closely on the malware’s external (i...
متن کامل