NDLI: Malware Behavior Analysis in Isolated Miniature Network for Revealing Malware's Network Activity

Content Provider	IEEE Xplore Digital Library
Author	Inoue, D. Yoshioka, K. Eto, M. Hoshizawa, Y. Nakao, K.
Copyright Year	2008
Description	Author affiliation: Nat. Inst. of Inf. & Commun. Technol. (NICT), Tokyo (Inoue, D.; Yoshioka, K.; Eto, M.)
Abstract	Malware, such as computer viruses, worms, and bots, has been recognized as one of the major security threats in the Internet environment, and a large amount of research and development is taking place to find effective countermeasures. These countermeasures are mainly based on either macroscopic or microscopic analysis. Macroscopic analysis is based on monitoring the network in order to grasp the global trends of malware propagations while microscopic analysis investigates malware executables to identify the details of how they behave. We have been developing the network incident analysis center for tactical emergency response (NICTER), where both kinds of analysis are highly integrated. By integrating and correlating the results from the both two approaches, the nicter binds phenomena, i.e., scans observed by network monitoring with their root causes, i.e., malwares. Previous analysis of malware has mainly focused on their internal behavior in the system. However, in order to achieve such a goal, it is crucial that the microscopic analysis extracts a malware's external behavior towards the network. We propose a novel way to analyze malware behavior: focus closely on the malware's external behavior. A malware sample is executed on a real machine that is connected to a virtual Internet environment called a "miniature network". Since this analysis environment is totally isolated from the real Internet, the execution of the sample, unlike in previously proposed methods, causes no further unwanted propagation. Furthermore, the behavioral analysis is carried out in two passes. In the first pass, in order to extract a wider variety of network behaviors from the sample, the miniature network responds as interactively as possible. In the second pass, to make only suitable response that will enable us to concentrate on specific behavior, namely scan behaviors, the miniature network is configured on the basis of the first pass result. We also present concrete analysis results that are gained by using the proposed method.
Starting Page	1715
Ending Page	1721
File Size	392748
Page Count	7
File Format	PDF
ISBN	9781424420759
DOI	10.1109/ICC.2008.330
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-05-19
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Microscopy Monitoring IP networks Information analysis Microwave integrated circuits Telecommunication traffic Communications Society Communications technology Computer viruses Computer worms
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in