NDLI: Segmented sandboxing - A novel approach to Malware polymorphism detection

Please wait, while we are loading the content...

Segmented sandboxing - A novel approach to Malware polymorphism detection

Content Provider	IEEE Xplore Digital Library
Author	Colon Osorio, F.C. Qiu, H. Arrott, A.
Copyright Year	2015
Description	Author affiliation: Wireless Systems Security Research Laboratory and Brandeis University (Colon Osorio, F.C.; Qiu, H.) \|\| Director of Security Analytics CheckVir CheckVir, USA (Arrott, A.)
Abstract	Malware polymorphic and metamorphic obfuscation techniques combined with so-called "sandboxing evasion techniques" continue to erode the effectiveness of both static detection (signature matching), and dynamic detection (sandboxing). Specifically, signature based techniques are overwhelmed by the sheer number of samples generated from a single seminal binary through the use of polymorphic variations (encryption, ISP obfuscation together with ISP emulators, semantically neutral transformations, and so forth). Anti-virus security vendors often report more than 100,000 new Malware signatures a day. In most cases, the preponderance of these variations can be attributed to just a handful of seminal Malware families. In 2011, FireEye reported that over 50% of observed successful Malware infections were attributable to just 13 Malware families (seminals).1 Similarly, sandboxing2, also known as dynamic Malware detection, has suffered from its own set of limitations. Mainly, (1) Malware writers embed in their code the ability to discover virtualized environments by checking for live internet access, or certain system properties inherent to virtualized environments, (2) Wait and seek (aka dormant Malware), a technique where knowing the execution time limitations of sandboxes, the Malware just waits, and (3) evasion techniques based on diverse communication. While the benefits of either dynamic or static approaches for Malware detection look quite tempting from each of their counterpart’s perspectives, their weakness are daunting in their own right as well. In this manuscript we attempted to combine the best part of both approaches, while minimizing the disadvantages of either of them. We call this mixed approach "static Malware detection with segmented sandboxing". It was first developed by modeling the problem from a classical automata theory that leads from a formal problem formulation to a practical solution implementation. Preliminary results have shown that this approach is extremely effective in at least two significant ways. First, it sequentially minimizes both false negatives (misses) and false positives (FPs) enabling response resources to be focused on a more complete set of attacks with far less distraction from false alarms. Second, it overcomes many of the known limitations of sandboxing technology.
Starting Page	59
Ending Page	68
File Size	706368
Page Count	10
File Format	PDF
ISBN	9781509003174
e-ISBN	9781509003198
DOI	10.1109/MALWARE.2015.7413685
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-10-20
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Semantics Automata Manuals Malware Software Engines
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Static malware detection with Segmented Sandboxing

A semantics-based approach to malware detection

A semantics-based approach to malware detection

A Network Based Approach to Malware Detection in Large IT Infrastructures

S.: A semantics-based approach to malware detection (2007)

A semantics-based approach to malware detection (2007)

S.: A semantics-based approach to malware detection (2007)

Towards a sandbox for the deobfuscation and dissection of PHP malware

A SemanticsBased Approach to Malware Detection (2007)

Segmented sandboxing - A novel approach to Malware polymorphism detection

Similar Documents

Static malware detection with Segmented Sandboxing

A semantics-based approach to malware detection

A semantics-based approach to malware detection

A Network Based Approach to Malware Detection in Large IT Infrastructures

S.: A semantics-based approach to malware detection (2007)

A semantics-based approach to malware detection (2007)

S.: A semantics-based approach to malware detection (2007)

Towards a sandbox for the deobfuscation and dissection of PHP malware

A SemanticsBased Approach to Malware Detection (2007)

Segmented sandboxing - A novel approach to Malware polymorphism detection