Please enable JavaScript.

Coggle requires JavaScript to display documents.

2017 - A Survey On Automated Dynamic Malware Analysis Evasion and Counter…

- - - - Unique systems traits
      - Categories
        
        Environmental Artifacts
        
        Distinguishing traits of the analysis system’s environment
        
        Originated from : virtualization infrastructure, analysis instrumentation, or system configuration
        
        Example: Unique usernames, system settings, files present on disk, installed drivers
        
        Timing
        
        Since timing is difficult to stimulate on virtualized hardware, inconsistencies in timing is used to deetect virtualization
        
        Example: Timing skews, discrepancies, and overhead
        
        CPU Virtualization
        
        Instructions which behave differently when run on virtualized CPU can be used to detect virtualization
        
        Example
        
        Process Introspection
        
        Fingerprints associated with the runtime state of a program that the program may detect by looking into its own state
        
        Example: Injected libraries, function hooks, dynamic binary instrumentation
        
        Reverse Turing Tests
        
        Some malware may choose to run only if it detects a
        human using the system
        
        Example: Lack of keyboard or mouse input, copy-paste clipboard data, web browser history, login times
        
        Network Artifacts
        
        Network behavior and traits in analysis systems can be
        used for analysis detection
        
        Example: fixed IP addresses, extremely fast internet service, network simulation, or even network isolation
        
        Mobile Sensors
        
        Implementing virtualized analysis systems for mobile devices face unique challenges in emulating the sensors built into these devices, e.g. multiple radios (e.g., cellular, WiFi, Bluetooth, NFC), cameras, microphones, GPS, accelerometers, gyroscopes, thermometers, barometers, proximity sensors, light sensors,
        
        Browser Specific
        
        Fingerprints unique to web browser analysis systems
  - - - Out-of-system
        
        e.g., virtual machine introspection, hypervisor traps, network monitoring, or hardware instrumentation
      - In-system
        
        e.g., an observing process, injected libraries, function hooks, or kernel drivers
    - - Making analysis systems indistinguishable to malware
      - Requirement
        
        Must run at higher privilege than the malware under analysis
        
        Identical instruction execution semantics
        
        Transparent exception handling
        
        Identical measurement of time
    - - Emulators
        
        Run all guest hardware instructions in software.
        
        Can easily control, monitor, and modify
        system state
        
        Increased introspection and privilege afforded by emulators generally comes at the cost of reduced transparency
        
        Example in malware analysis: QEMU
      - Hosted Virtual Machine
        
        Virtual machines which run within existing host operating systems
        
        Run the majority of instructions from the guest system directly on hardware
        
        Example in malware analysis: Cuckoo
      - Hypervisor
        
        Systems run directly on physical hardware, and virtualize code of the same architecture as the host
        
        Due to their relatively lower overhead, hypervisors are generally more transparent than other virtualization systems
    - - Has been used to counter counter virtualization-resistant malware
      - Run and analyze malware on real hardware
      - More transparent than virtualized analysis systems, but less insight into malware behavior and challenges in scalability
    - - Instrumented
        browsers
      - Browser emulator
      - Approaches
    - - Generally been implemented using emulators
  - - - Measuring virtual machine detection in
        malware using DSD tracer
        
        Combines static and dynamic analysis
        
        Boris Lau and Vanja Svajcer. 2008
        
        Runs malware in Bochs and VMware and obtains
        instruction execution traces from both systems
        
        Python scripts analyze malware execution trace looking for VMM detection techniques
      - Anti-analysis techniques are known in advance
    - - Malware is run on two or more analysis systems, and information about execution is compared in order to determine if the malware exhibits evasion in one or more of the system
      - Detection At The Instruction Level
      - Detection At The System Call Level
      - Detection Through Persistent Changes To System State
    - - Alexandros Kapravelos, Yan Shoshitaishvili, Marco Cova, Christopher Kruegel, and Giovanni Vigna. 2013
      - Revolver: An Automated Approach to the Detection
        of Evasive Web-based Malware
      - Identifying analysis evasion in JavaScript web malware
  - - - Cobra: Fine-grained Malware Analysis using Stealth Localized-executions
      - Authors: Amit Vasudevan and Ramesh Yerraballi
      - Dynamically removing or rewriting instructions in its
        execution blocks to prevent detection
      - Mitigates malware which evasion technique is known
    - - Toward Automated Dynamic Malware Analysis Using CWSandbox
      - Authors: Carsten Willems, Thorsten Holz, and Felix Freiling
      - VMware-based system that uses in-system
        instrumentation
      - Hide its environmental artifacts (e.g., files, registry entries, mutexes) from malware by hooking operating system functions that could reveal their presence
    - - Exploring Multiple Execution Paths for Malware Analysis
      - Detection and Analysis of Drive-by-Download Attacks and Malicious JavaScript Code
        
        Forces the invocation of JavaScript functions in web malware if the functions were not called during regular execution
        
        Marco Cova, Christopher Kruegel, and Giovanni Vigna. 2010
      - X-Force: Force-Executing Binary Programs for Security Applications
        
        Forces malware execution without using any inputs or environmental setup
      - Automatically Identifying Trigger-based Behavior in Malware.
        
        David Brumley, Cody Hartwig, Zhenkai Liang, James Newsome, Dawn Song, and Heng Yin. 2008
      - Rozzle: De-Cloaking Internet Malware
        
        Identify web malware by using multi-path JavaScript exploration
      - J-Force: Forced Execution on JavaScript
        
        Forces path exploration by recording branch outcomes and mutating them
        
        Forced execution systems may crash because of references to missing DOM elements, J-Force is able to dynamically create new DOM elements on demand as needed to allow execution to continue.
      - Forced-Path Execution for Android Applications on x86 Platforms
        
        Forces execution with instrumented Dalvik bytecode in order to discover potential behaviors in Android apps including malware.
      - Path exploration-based approaches force malware code execution down multiple possible conditional branches in order to achieve better code coverage and to mitigate evasion
      - Malware can actively subvert exploration efforts with techniques drawn from anti-symbolic execution obfuscation or anti-fuzzing
    - - Modification of program execution state (i.e., registers or memory) at given points during execution
      - After identifying a root point of evasion, in order to make execution proceed further, program execution state can modified to force code to take alternate branches.
      - Emulating Emulation-Resistant Malware
      - Min Gyung Kang, Heng Yin, Steve Hanna, Stephen McCamant, and Dawn Song. 2009
    - - V2E : Combining Hardware Virtualization and Software Emulation for Transparent and Extensible Malware Analysis
      - Lok-kwong Yan, Manjukumar Jayachandra, Mu Zhang, and Heng Yin. 2
      - Decoupling recording and analysis
        
        Replays executed code under analysis in Temu
        
        Collects information about malware execution within KVM
        
        KVM provides transparency
        
        TEMU provide binary instrumentation