FAROS: Illuminating In-memory Injection Attacks via Provenance-Based Whole-System Dynamic Information Flow Tracking

Arefi, Meisam Navaki; Alexander, Geoffrey; Rokham, Hooman; Chen, Aokun; Faloutsos, Michalis; Wei, Xuetao; Oliveira, Daniela; Crandall, Jedidiah R.

doi:10.1109/dsn.2018.00034

Cited by 6 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, this leads to performing restoration at the file granularity and potentially removing more recent bytes from a file than strictly necessary during the process. Future work may focus on minimizing the effects of implicit flows, similar to [14], in order to improve the precision of intrusion recovery.…”

Section: Directions For Future Researchmentioning

confidence: 99%

Securing Modern Storage Stacks

Bacs

View full text Add to dashboard Cite

Modern storage stacks implement persistent memory which is a core component of computing systems. This dissertation considers threats that affect the storage stack, discussing solutions to analyze and reduce the resulting attack surface in pre- and post-compromise scenarios. On the attack surface analysis front, we first identified and studied a new class of advanced attacks based on a timing side channel (pre-compromise scenario). The latter originates from the filesystem deduplication feature of modern filesystems like ZFS and Btrfs. We showed how an attacker can abuse the side channel to leak sensitive data at the byte or block granularity, bypassing traditional filesystem access controls. We proposed a mitigation where the read and write operations exhibit the same behavior in the time domain, regardless of the presence of the data on storage. To explore the post-compromise attack surface, we introduced lightweight instrumentation to track low-level storage operations, observing any malicious interactions with the storage stack. This was helpful to study an important class of persistent malware (bootkits) for a large period of time. As a result, we derived its storage-related characteristics and proposed mitigations for it. On the attack surface reduction front, we first studied and proposed a generic intrusion detection system for the virtualized storage stack with low overhead (pre- compromise scenario). Next, we proposed a post-compromise solution for intrusion recovery, which is operating system agnostic and uses heavyweight instrumentation to precisely track malicious data through the system at the byte granularity. In the process, we addressed important challenges such as reducing the semantic gap to have a more precise recovery granularity and hiding the instrumentation overhead by means of a decoupled security model.

show abstract

Section: Directions For Future Researchmentioning

confidence: 99%

Securing Modern Storage Stacks

Bacs

View full text Add to dashboard Cite

show abstract

A Praise for Defensive Programming: Leveraging Uncertainty for Effective Malware Mitigation

Sun

Botacin

Sapountzis

et al. 2022

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network

Liu

Feng

et al. 2023

Cybersecurity

View full text Add to dashboard Cite

Cyber attackers have constantly updated their attack techniques to evade antivirus software detection in recent years. One popular evasion method is to execute malicious code and perform malicious actions only in memory. Malicious programs that use this attack method are called memory-resident malware, with excellent evasion capability, and have posed huge threats to cyber security. Traditional static and dynamic methods are not effective in detecting memory-resident malware. In addition, existing memory forensics detection solutions perform unsatisfactorily in detection rate and depend on massive expert knowledge in memory analysis. This paper proposes MRm-DLDet, a state-of-the-art memory-resident malware detection framework, to overcome these drawbacks. MRm-DLDet first builds a virtual machine environment and captures memory dumps, then creatively processes the memory dumps into RGB images using a pre-processing technique that combines deduplication and ultra-high resolution image cropping, followed by our neural network MRmNet in MRm-DLDet to fully extract high-dimensional features from memory dump files and detect them. MRmNet receives the labeled sub-images of the cropped high-resolution RGB images as input of ResNet-18, which extracts the features of the sub-images. Then trains a network of gated recurrent units with an attention mechanism. Finally, it determines whether a program is memory-resident malware based on the detection results of each sub-image through a specially designed voting layer. We created a high-quality dataset consisting of 2,060 benign and memory-resident programs. In other words, the dataset contains 1,287,500 labeled sub-images cut from the MRm-DLDet transformed ultra-high resolution RGB images. We implement MRm-DLDet for Windows 10, and it performs better than the latest methods, with a detection accuracy of up to 98.34$$\%$$ % . Moreover, we measured the effects of mimicry and adversarial attacks on MRm-DLDet, and the experimental results demonstrated the robustness of MRm-DLDet.

show abstract

FAROS: Illuminating In-memory Injection Attacks via Provenance-Based Whole-System Dynamic Information Flow Tracking

Cited by 6 publications

References 22 publications

Securing Modern Storage Stacks

Securing Modern Storage Stacks

A Praise for Defensive Programming: Leveraging Uncertainty for Effective Malware Mitigation

MRm-DLDet: a memory-resident malware detection framework based on memory forensics and deep neural network

Contact Info

Product

Resources

About