Automated analysis of system-wide malware propagation
<p>In contrast to most benign applications, malware infects its host system. It does so via system-wide execution by injecting code into otherwise benign applications, executing via code-reuse attacks, dynamically generating code and much more. These unconventional, albeit perfectly valid, exe...
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Published: |
2019
|
| _version_ | 1797102754254028800 |
|---|---|
| author | Korczynski, D |
| author2 | Roscoe, B |
| author_facet | Roscoe, B Korczynski, D |
| author_sort | Korczynski, D |
| collection | OXFORD |
| description | <p>In contrast to most benign applications, malware infects its host system. It does so via system-wide execution by injecting code into otherwise benign applications, executing via code-reuse attacks, dynamically generating code and much more. These unconventional, albeit perfectly valid, execution paradigms are used for evasion and obfuscation tactics and pose significant problems to automatic malware analysis environments.</p> <p>In this thesis, we investigate the problem of system-wide malware execution. We focus on building general and precise techniques to analyse malware that execute throughout the entire system. To demonstrate our techniques, we implement them as part of a malware analysis system called Minerva. We use Minerva to perform extensive empirical studies based on synthetic benchmarks that explore corner-case behaviours as well as real-world malware samples collected from the wild.</p> <p>The core idea behind our techniques is to analyse system-wide malware execution with a bottom-up approach. To this end, we develop a fundamental technique for capturing the system-wide execution trace of a given malware sample that is independent of the techniques malware use to propagate through the system. We then incrementally build abstractions upon this trace to identify code injections, malware droppers, code-reuse attacks, packed malware and more.</p> <p>In the final part of our thesis, we extend Minerva with several capabilities to perform large-scale studies. We use these features to characterise system-wide malware propagation at large and extract many interesting high-level views on malware based on our precise and general analysis.</p> |
| first_indexed | 2024-03-07T06:10:17Z |
| format | Thesis |
| id | oxford-uuid:ef3faf5e-7733-4460-bba4-9e18893dec1e |
| institution | University of Oxford |
| last_indexed | 2024-03-07T06:10:17Z |
| publishDate | 2019 |
| record_format | dspace |
| spelling | oxford-uuid:ef3faf5e-7733-4460-bba4-9e18893dec1e2022-03-27T11:38:55ZAutomated analysis of system-wide malware propagationThesishttp://purl.org/coar/resource_type/c_db06uuid:ef3faf5e-7733-4460-bba4-9e18893dec1eORA Deposit2019Korczynski, DRoscoe, BO’Halloran, C<p>In contrast to most benign applications, malware infects its host system. It does so via system-wide execution by injecting code into otherwise benign applications, executing via code-reuse attacks, dynamically generating code and much more. These unconventional, albeit perfectly valid, execution paradigms are used for evasion and obfuscation tactics and pose significant problems to automatic malware analysis environments.</p> <p>In this thesis, we investigate the problem of system-wide malware execution. We focus on building general and precise techniques to analyse malware that execute throughout the entire system. To demonstrate our techniques, we implement them as part of a malware analysis system called Minerva. We use Minerva to perform extensive empirical studies based on synthetic benchmarks that explore corner-case behaviours as well as real-world malware samples collected from the wild.</p> <p>The core idea behind our techniques is to analyse system-wide malware execution with a bottom-up approach. To this end, we develop a fundamental technique for capturing the system-wide execution trace of a given malware sample that is independent of the techniques malware use to propagate through the system. We then incrementally build abstractions upon this trace to identify code injections, malware droppers, code-reuse attacks, packed malware and more.</p> <p>In the final part of our thesis, we extend Minerva with several capabilities to perform large-scale studies. We use these features to characterise system-wide malware propagation at large and extract many interesting high-level views on malware based on our precise and general analysis.</p> |
| spellingShingle | Korczynski, D Automated analysis of system-wide malware propagation |
| title | Automated analysis of system-wide malware propagation |
| title_full | Automated analysis of system-wide malware propagation |
| title_fullStr | Automated analysis of system-wide malware propagation |
| title_full_unstemmed | Automated analysis of system-wide malware propagation |
| title_short | Automated analysis of system-wide malware propagation |
| title_sort | automated analysis of system wide malware propagation |
| work_keys_str_mv | AT korczynskid automatedanalysisofsystemwidemalwarepropagation |