NDLI: Temporal search:detecting hidden malware timebombs with virtual machines (CARN, Vol. 34, Issue. 5)

Content Provider	ACM Digital Library
Author	Wu, S. Felix Wassermann, Gary Chong, Frederic T. Crandall, Jedidiah R. de Oliveira, Daniela A. S. Su, Zhendong
Abstract	Worms, viruses, and other malware can be ticking bombs counting down to a specific time, when they might, for example, delete files or download new instructions from a public web server. We propose a novel virtual-machine-based analysis technique to automatically discover the timetable of a piece of malware, or when events will be triggered, so that other types of analysis can discern what those events are. This information can be invaluable for responding to rapid malware, and automating its discovery can provide more accurate information with less delay than careful human analysis.Developing an automated system that produces the timetable of a piece of malware is a challenging research problem. In this paper, we describe our implementation of a key component of such a system: the discovery of timers without making assumptions about the integrity of the infected system's kernel. Our technique runs a virtual machine at slightly different rates of perceived time (time as seen by the virtual machine), and identifies time counters by correlating memory write frequency to timer interrupt frequency.We also analyze real malware to assess the feasibility of using full-system, machine-level symbolic execution on these timers to discover predicates. Because of the intricacies of the Gregorian calendar (leap years, different number of days in each month, etc.) these predicates will not be direct expressions on the timer but instead an annotated trace; so we formalize the calculation of a timetable as a weakest precondition calculation. Our analysis of six real worms sheds light on two challenges for future work: 1) time-dependent malware behavior often does not follow a linear timetable; and 2) that an attacker with knowledge of the analysis technique can evade analysis. Our current results are promising in that with simple symbolic execution we are able to discover predicates on the day of the month for four real worms. Then through more traditional manual analysis we conclude that a more control-flow-sensitive symbolic execution implementation would discover all predicates for the malware we analyzed.
Starting Page	25
Ending Page	36
Page Count	12
File Format	PDF
ISSN	01635964
DOI	10.1145/1168919.1168862
Journal	ACM SIGARCH Computer Architecture News (CARN)
Volume Number	34
Issue Number	5
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1981-04-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Malware Virtual machines Worms
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Temporal search:detecting hidden malware timebombs with virtual machines (OPSR, Vol. 40, Issue. 5)

Temporal search:detecting hidden malware timebombs with virtual machines (SIGP, Vol. 41, Issue. 11)

Temporal search: detecting hidden malware timebombs with virtual machines

Geiger:monitoring the buffer cache in a virtual machine environment (CARN, Vol. 34, Issue. 5)

Temporal Search: Detecting Hidden Malware Timebombs with Virtual Machines (2006)

Stealth prefetching (CARN, Vol. 34, Issue. 5)

Hybrid transactional memory (CARN, Vol. 34, Issue. 5)

Devirtualizable virtual machines enabling general, single-node, online maintenance (CARN, Vol. 32, Issue. 5)

Unbounded page-based transactional memory (CARN, Vol. 34, Issue. 5)

Temporal search:detecting hidden malware timebombs with virtual machines (CARN, Vol. 34, Issue. 5)

Similar Documents

Temporal search:detecting hidden malware timebombs with virtual machines (OPSR, Vol. 40, Issue. 5)

Temporal search:detecting hidden malware timebombs with virtual machines (SIGP, Vol. 41, Issue. 11)

Temporal search: detecting hidden malware timebombs with virtual machines

Geiger:monitoring the buffer cache in a virtual machine environment (CARN, Vol. 34, Issue. 5)

Temporal Search: Detecting Hidden Malware Timebombs with Virtual Machines (2006)

Stealth prefetching (CARN, Vol. 34, Issue. 5)

Hybrid transactional memory (CARN, Vol. 34, Issue. 5)

Devirtualizable virtual machines enabling general, single-node, online maintenance (CARN, Vol. 32, Issue. 5)

Unbounded page-based transactional memory (CARN, Vol. 34, Issue. 5)

Temporal search:detecting hidden malware timebombs with virtual machines (CARN, Vol. 34, Issue. 5)