A Layered Architecture for Detecting Malicious Behaviors

Martignoni, Lorenzo; Stinson, Elizabeth; Fredrikson, Matt; Jha, Somesh; Mitchell, John C.

doi:10.1007/978-3-540-87403-4_5

Cited by 89 publications

(74 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other approaches overcame this limitation by focusing on information flows rather than on mere sequences of syscalls. Malware profiles, by leveraging more-contextual information in terms of library [5] or system calls [9,6], started to grasp the semantics lying behind a malicious activity. However, mimicry attacks were still possible [7].…”

Section: Related Workmentioning

confidence: 99%

KLIMAX: Profiling Memory Write Patterns to Detect Keystroke-Harvesting Malware

Ortolani

Giuffrida

Crispo

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Privacy-breaching malware is an ever-growing class of malicious applications that attempt to steal confidential data and leak them to third parties. One of the most prominent activities to acquire private user information is to eavesdrop and harvest user-issued keystrokes. Despite the serious threat involved, keylogging activities are challenging to detect in the general case. From an operating system perspective, their general behavior is no different than that of legitimate applications used to implement common end-user features like custom shortcut handling and keyboard remapping. As a result, existing detection techniques that attempt to model malware behavior based on system or library calls are largely ineffective. To address these concerns, we introduce a novel detection technique based on fine-grained profiling of memory write patterns. The intuition behind our model lies in data harvesting being a good predictor for sensitive information leakage. To demonstrate the viability of our approach, we have designed and implemented KLIMAX: a KernelLevel Infrastructure for Memory and eXecution profiling. Our system supports proactive and reactive detection and can be transparently deployed online on a running Windows platform. Experimental results with real-world malware confirm the effectiveness of our approach.

show abstract

Section: Related Workmentioning

confidence: 99%

KLIMAX: Profiling Memory Write Patterns to Detect Keystroke-Harvesting Malware

Ortolani

Giuffrida

Crispo

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Finally, the whole abstraction process could be repeated, as in Martignoni et al's layered architecture [19]. A first layer would look up behavior patterns defined in terms of raw analysis data.…”

Section: Projecting the Abstract Trace Language On γmentioning

confidence: 99%

“…Recent approaches [19] deal with functional polymorphism by preprocessing execution traces and transforming them into a high-level representation which captures their semantic meaning. But as these approaches deal with the execution trace being observed, they analyze a single behavior at a time.…”

Section: Introductionmentioning

confidence: 99%

Behavior Abstraction in Malware Analysis

Beaucamps

Gnaedig

Marion

2010

Runtime Verification

View full text Add to dashboard Cite

Abstract. We present an approach for proactive malware detection working by abstraction of program behaviors. Our technique consists in abstracting program traces, by rewriting given subtraces into abstract symbols representing their functionality. Traces are captured dynamically by code instrumentation, which allows us to handle packed or self-modifying malware. Suspicious behaviors are detected by comparing trace abstractions to reference malicious behaviors. The expressive power of abstraction allows us to handle general suspicious behaviors rather than specific malware code and then, to detect malware mutations. We present and discuss an implementation validating our approach.

show abstract

“…Anti-malware tools are only able to detect known instances and the success rate is circa 30 % [1]. In an effort to extend both the static and dynamic approaches, some researchers apply machine learning (ML) algorithms, which show promising results both in detecting known and new malware.…”

Section: Introductionmentioning

confidence: 99%