Agent-based Vs Agent-less Sandbox for Dynamic Behavioral Analysis

Ali, Muhammad Junaid; Shiaeles, Stavros; Papadaki, Maria; Ghita, Bogdan

doi:10.1109/giis.2018.8635598

Cited by 11 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When detecting that it is being analysed by the sandbox agent, some malware modifies its behaviour, causing the analysis to yield incorrect results. The latest research work suggests [36,37] that traditional sandboxes are not evasive resistance because they hook data by dropping their agent in a controlled environment that can be easily detected by advanced strains of malware. As a result, they either stop their executing or execute with limited functionality.…”

Section: Related Workmentioning

confidence: 99%

“…(a) Malware behavioural modelling using advance sandbox: In contrast to other studies and research work where the traditional sandboxes such as Cuckoo, Norman, Joe, etc. were used to model the behaviour of malware as from our previous research work [36], we found that they are not so effective in capturing the behaviour of advanced and sophisticated malware; therefore, we have utilized AI-based sandbox in this work to perform dynamic analysis and to model the behaviour of the malware.…”

Section: N-gramsmentioning

confidence: 99%

See 1 more Smart Citation

MALGRA: Machine Learning and N-Gram Malware Feature Extraction and Detection System

et al. 2020

Self Cite

View full text Add to dashboard Cite

Detection and mitigation of modern malware are critical for the normal operation of an organisation. Traditional defence mechanisms are becoming increasingly ineffective due to the techniques used by attackers such as code obfuscation, metamorphism, and polymorphism, which strengthen the resilience of malware. In this context, the development of adaptive, more effective malware detection methods has been identified as an urgent requirement for protecting the IT infrastructure against such threats, and for ensuring security. In this paper, we investigate an alternative method for malware detection that is based on N-grams and machine learning. We use a dynamic analysis technique to extract an Indicator of Compromise (IOC) for malicious files, which are represented using N-grams. The paper also proposes TF-IDF as a novel alternative used to identify the most significant N-grams features for training a machine learning algorithm. Finally, the paper evaluates the proposed technique using various supervised machine-learning algorithms. The results show that Logistic Regression, with a score of 98.4%, provides the best classification accuracy when compared to the other classifiers used.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: N-gramsmentioning

confidence: 99%

MALGRA: Machine Learning and N-Gram Malware Feature Extraction and Detection System

et al. 2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…For this experiment we utilised an Agentless (VMRay Analyzer) and AI-based (SNDBOX) sandbox. VMRay Analyser as aforementioned is an agentless sandbox cloud solution and the reason choosing this platform is that some sophisticate malware usually monitor the running environment and to prevent their discovery they usually stop their execution which provides insignificant features to the analysis (Ali et al, 2018). SNDBOX applies an invisible kernel mode agent and AI to offer the next generation Sandbox, extending the individual capabilities and expertise of security and research teams through AI, dynamic analysis and network mapping.…”

Section: Virtual Labmentioning

confidence: 99%

A proactive malicious software identification approach for digital forensic examiners

Ali

Shiaeles

Clarke

et al. 2019

Journal of Information Security and Applications

Self Cite

View full text Add to dashboard Cite

Digital investigators often get involved with cases which seemingly point the responsibility to the person to which the computer belongs, but after a thorough examination malware is proven to be the cause, causing loss of precious time. Whilst Anti-Virus (AV) software can assist the investigator in identifying the presence of malware, with the increase in zero-day attacks and errors that exist in AV tools, this is something that cannot be relied upon. The aim of this paper is to investigate the behavior of malware upon various Windows operating system versions in order to determine and correlate the relationship between malicious software and OS artifacts. This will enable an investigator to be more efficient in identifying the presence of new malware and provide a starting point for further investigation.The study analyzed several versions of the Windows operating systems (Windows 7, 8.1 and 10) and monitored the interaction of 90 samples of malware across three categories of the most prevalent (Trojan, Worm, and Bot) and 90 benign samples through the Windows Registry. Analysis of the interactions has provided a rich source of knowledge about how various forms of malware interact with key areas of the Registry. Using this knowledge, the study sought to develop an approach to predict the presence and type of malware present through an analysis of the Registry. To this end, different classifiers such as Neural Network, Random forest, Decision tree, Boosted tree and Logistic Regression were tested. It was observed that Boosted tree was resulting in a correct classification of over 72% -providing the investigator with a simple approach to determining which type of malware might be present independent and faster than an Antivirus. The modeling of these findings and their integration in an application or forensic analysis within an existing tool would be useful for digital forensic investigators.

show abstract