NDLI: V2E:combining hardware virtualization and softwareemulation for transparent and extensible malware analysis

Please wait, while we are loading the content...

V2E:combining hardware virtualization and softwareemulation for transparent and extensible malware analysis

Content Provider	ACM Digital Library
Author	Yan, Lok-Kwong Yin, Heng Zhang, Mu Jayachandra, Manjukumar
Abstract	A transparent and extensible malware analysis platform is essential for defeating malware. This platform should be transparent so malware cannot easily detect and bypass it. It should also be extensible to provide strong support for heavyweight instrumentation and analysis efficiency. However, no existing platform can meet both requirements. Leveraging hardware virtualization technology, analysis platforms like Ether can achieve good transparency, but its instrumentation support and analysis efficiency is poor. In contrast, software emulation provides strong support for code instrumentation and good analysis efficiency by using dynamic binary translation. However, analysis platforms based on software emulation can be easily detected by malware and thus is poor in transparency. To achieve both transparency and extensibility, we propose a new analysis platform that combines hardware virtualization and software emulation. The essence is precise heterogeneous replay: the malware execution is recorded via hardware virtualization and then replayed in software. Our design ensures the execution replay is precise. Moreover, with page-level recording granularity, the platform can easily adjust to analyze various forms of malware (a process, a kernel module, or a shared library). We implemented a prototype called V2E and demonstrated its capability and efficiency by conducting an extensive evaluation with both synthetic samples and 14 realworld emulation-resistant malware samples.
Starting Page	227
Ending Page	238
Page Count	12
File Format	PDF
ISSN	03621340 15581160
DOI	10.1145/2365864.2151053
Journal	ACM SIGPLAN Notices (SIGP)
Volume Number	47
Issue Number	7
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1983-05-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Emulation resistant Emulation Malware Qemu Hardware virtualization Record and replay
Content Type	Text
Resource Type	Article
Subject	Computer Graphics and Computer-Aided Design Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

V2E: combining hardware virtualization and softwareemulation for transparent and extensible malware analysis

V2E: Combining hardware virtualization and software emulation for transparent and extensible malware analysis (2012)

Transparent and extensible malware analysis by combining hardware virtualization and software emulation.

Improving Remote Desktopping Through Adaptive Record/Replay

Abstractions for Practical Virtual Machine Replay

Neon:system support for derived data management

Virtualization Evolution For Transparent Malware Analysis

Transparent, lightweight application execution replay on commodity multiprocessor operating systems

Efficient memory virtualization for Cross-ISA system mode emulation

V2E:combining hardware virtualization and softwareemulation for transparent and extensible malware analysis

Similar Documents

V2E: combining hardware virtualization and softwareemulation for transparent and extensible malware analysis

V2E: Combining hardware virtualization and software emulation for transparent and extensible malware analysis (2012)

Transparent and extensible malware analysis by combining hardware virtualization and software emulation.

Improving Remote Desktopping Through Adaptive Record/Replay

Abstractions for Practical Virtual Machine Replay

Neon:system support for derived data management

Virtualization Evolution For Transparent Malware Analysis

Transparent, lightweight application execution replay on commodity multiprocessor operating systems

Efficient memory virtualization for Cross-ISA system mode emulation

V2E:combining hardware virtualization and softwareemulation for transparent and extensible malware analysis