NDLI: BareBox: efficient malware analysis on bare-metal

Please wait, while we are loading the content...

Understanding the prevalence and use of alternative plans in malware with network games

Distilling critical attack graph surface iteratively through minimum-cost SAT solving

"Mix-in-Place" anonymous networking using secure function evaluation

The socialbot network: when bots socialize for fame and money

A peel of onion

The science of cyber security experimentation: the DETER project

Facing the facts about image type in recognition-based graphical passwords

Improving robustness of DNS to software vulnerabilities

Exploring the potential benefits of expanded rate limiting in Tor: slow and steady wins the race with Tortoise

SEMAGE: a new image-based two-factor CAPTCHA

ASIDE: IDE support for web application security

An empirical study of visual security cues to prevent the SSLstripping attack

Key escrow from a safe distance: looking back at the Clipper Chip

Reliable telemetry in white spaces using remote attestation

Mitigating code-reuse attacks with control-flow locking

Nexat: a history-based approach to predict attacker actions

BareBox: efficient malware analysis on bare-metal

FORECAST: skimming off the malware cream

RIPE: runtime intrusion prevention evaluator

Security through amnesia: a software-based solution to the cold boot attack on disk encryption

Detecting and resolving privacy conflicts for collaborative data sharing in online social networks

PhorceField: a phish-proof password ceremony

Enabling secure VM-vTPM migration in private clouds

"Super nodes" in Tor: existence and security implication

BLOCK: a black-box approach for detection of state violation attacks towards web applications

Tracking payment card data flow using virtual machine state introspection

AdSentry: comprehensive and flexible confinement of JavaScript-based advertisements

Don't Bump, Shake on It: the exploitation of a popular accelerometer-based smart phone exchange and its secure replacement

deRop: removing return-oriented programming from malware

From prey to hunter: transforming legacy embedded devices into exploitation sensor grids

Automated remote repair for mobile malware

Detecting malware's failover C&C strategies with squeeze

Hit 'em where it hurts: a live security exercise on cyber situational awareness

Private search in the real world

Social snapshots: digital forensics for online social networks

Dynamic sample size detection in continuous authentication using sequential sampling

Exposing invisible timing-based traffic watermarks with BACKLIT

Smart metering de-pseudonymization

A server- and browser-transparent CSRF defense for web 2.0 applications

WebJail: least-privilege integration of third-party components in web mashups

Attacks on WebView in the Android system

Static detection of malicious JavaScript-bearing PDF documents

BareBox: efficient malware analysis on bare-metal

Content Provider	ACM Digital Library
Author	Kruegel, Christopher Kirat, Dhilung Vigna, Giovanni
Abstract	Present-day malware analysis techniques use both virtualized and emulated environments to analyze malware. The reason is that such environments provide isolation and system restoring capabilities, which facilitate automated analysis of malware samples. However, there exists a class of malware, called VM-aware malware, which is capable of detecting such environments and then hide its malicious behavior to foil the analysis. Because of the artifacts introduced by virtualization or emulation layers, it has always been and will always be possible for malware to detect virtual environments. The definitive way to observe the actual behavior of VM-aware malware is to execute them in a system running on real hardware, which is called a "bare-metal" system. However, after each analysis, the system must be restored back to the previous clean state. This is because running a malware program can leave the system in an instable/insecure state and/or interfere with the results of a subsequent analysis run. Most of the available state-of-the-art system restore solutions are based on disk restoring and require a system reboot. This results in a significant downtime between each analysis. Because of this limitation, efficient automation of malware analysis in bare-metal systems has been a challenge. This paper presents the design, implementation, and evaluation of a malware analysis framework for bare-metal systems that is based on a fast and rebootless system restore technique. Live system restore is accomplished by restoring the entire physical memory of the analysis operating system from another, small operating system that runs outside of the target OS. By using this technique, we were able to perform a rebootless restore of a live Windows system, running on commodity hardware, within four seconds. We also analyzed 42 malware samples from seven different malware families, that are known to be "silent" in a virtualized or emulated environments, and all of them showed their true malicious behavior within our bare-metal analysis environment.
Starting Page	403
Ending Page	412
Page Count	10
File Format	PDF
ISBN	9781450306720
DOI	10.1145/2076732.2076790
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2011-12-05
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Dynamic malware analysis Bare metal Vm-aware System restore
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Barebox: efficient malware analysis on bare-metal.

Barecloud: bare-metal analysis-based evasive malware detection.

BareCloud: Bare-metal Analysis-based Evasive Malware Detection

Fast Discovery of VM-Sensitive Divergence Points with Basic Block Comparison

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing

BareDroid: Large-Scale Analysis of Android Apps on Real Devices

Efficient Bare Metal Backup and Restore in OpenStack Based Cloud InfrastructureDesign : Implementation and Testing of a Prototype

Efficient Energy-Aware Resource Management Model (EEARMM) Based Dynamic VM Migration

A robust dynamic analysis system preventing SandBox detection by Android malware

BareBox: efficient malware analysis on bare-metal

Similar Documents

Barebox: efficient malware analysis on bare-metal.

Barecloud: bare-metal analysis-based evasive malware detection.

BareCloud: Bare-metal Analysis-based Evasive Malware Detection

Fast Discovery of VM-Sensitive Divergence Points with Basic Block Comparison

MAXS: Scaling Malware Execution with Sequential Multi-Hypothesis Testing

BareDroid: Large-Scale Analysis of Android Apps on Real Devices

Efficient Bare Metal Backup and Restore in OpenStack Based Cloud InfrastructureDesign : Implementation and Testing of a Prototype

Efficient Energy-Aware Resource Management Model (EEARMM) Based Dynamic VM Migration

A robust dynamic analysis system preventing SandBox detection by Android malware

BareBox: efficient malware analysis on bare-metal