Hypervisor-assisted dynamic malware analysis

Abstract

Malware analysis is a task of utmost importance in cyber-security. Two approaches exist for malware analysis: static and dynamic. Modern malware uses an abundance of techniques to evade both dynamic and static analysis tools. Current dynamic analysis solutions either make modifications to the running malware or use a higher privilege component that does the actual analysis. The former can be easily detected by sophisticated malware while the latter often induces a significant performance overhead. We propose a method that performs malware analysis within the context of the OS itself. Furthermore, the analysis component is camouflaged by a hypervisor, which makes it completely transparent to the running OS and its applications. The evaluation of the system’s efficiency suggests that the induced performance overhead is negligible.

Fisher exact Boschloo and polynomial vector learning for malware detection

“…From Figure 2, performances were compared in terms of average attack detection time for distinct numbers of connections (i.e., count) ranging from 15 to 150. The results obtained show that the attack detection time of the proposed method FEB-PVL is better and rise more steadily than the other methods, [21], [22]. Moreover, it can also be inferred from Figure 2 that the proposed FEB-PVL method consumes less time to detect both the content and behavior types of attacks.…”

“…Table 2 shows the results of attack detection time using three methods, FEB-PVL, hypervisor content-based malware detection [21], and behavior-based malware detection [22] respectively. From the results, it is evident that FEB-PVL consumes comparatively minimum attack detection time than hypervisor content-based malware detection [21] and behavior-based malware detection [22]. For a detailed comparison of the methods, the indicator line chart is shown in Figure 2.…”

“…The motivation for malware detection is that the malware detection model concentrates mainly on content and behavior aspects [20]. Leon et al [21] performed a hypervisor-assisted dynamic malware analysis. The developed model detected the malware and the latter significantly showed improvement in performance.…”

Machine Learning-based Ransomware Detection Using Low-level Memory Access Patterns Obtained From Live-forensic Hypervisor

“…They also presented a forensic technique to monitor memory modifications by controlling page-grained permissions using EPT violations. Many state-of-the-art papers, including Sharmeen et al [1] and Leon et al [18], have employed process-level dynamic features. While these papers [1], [16]- [18] show a malware analysis method using process-level information, this paper presented a ransomware detection method using only low-level memory access patterns.…”

“…Many state-of-the-art papers, including Sharmeen et al [1] and Leon et al [18], have employed process-level dynamic features. While these papers [1], [16]- [18] show a malware analysis method using process-level information, this paper presented a ransomware detection method using only low-level memory access patterns. Our approach is also different from other hypervisors that mainly focus on dumping memory contents [19], [20].…”