Prudent Practices for Designing Malware Experiments: Status Quo and Outlook

Rossow, Christian; Dietrich, Christian; Grier, Chris; Kreibich, Christian; Paxson, Vern; Pohlmann, Norbert; Bos, Herbert; Steen, Maarten van

doi:10.1109/sp.2012.14

Cited by 169 publications

(130 citation statements)

References 34 publications

Supporting

Mentioning

128

Contrasting

Unclassified

Order By: Relevance

“…In their work, the authors already questioned the assessment protocols used in the state-of-the-art literature. Guidelines for conducting sound Malware Detection experiments were proposed by Rossow et al [33]. Our work follows the same objectives, aiming to highlight the importance of building a reliable assessment protocol for research approaches, in order to make them more useful for real-world problems.…”

Section: Related Workmentioning

confidence: 99%

Are Your Training Datasets Yet Relevant?

Allix

Bissyandé

Klein

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we consider the relevance of timeline in the construction of datasets, to highlight its impact on the performance of a machine learning-based malware detection scheme. Typically, we show that simply picking a random set of known malware to train a malware detector, as it is done in many assessment scenarios from the literature, yields significantly biased results. In the process of assessing the extent of this impact through various experiments, we were also able to confirm a number of intuitive assumptions about Android malware. For instance, we discuss the existence of Android malware lineages and how they could impact the performance of malware detection in the wild.

show abstract

Section: Related Workmentioning

confidence: 99%

Are Your Training Datasets Yet Relevant?

Allix

Bissyandé

Klein

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…These analyses are performed in a confined sandbox environment in conformity to recommended best practices [17].…”

Section: Experiments Set-up and Methodologymentioning

confidence: 99%

Towards Data Resilience: The Analytical Case of Crypto Ransomware Data Recovery Techniques

Zimba¹,

Wang²,

Simukonda³

2018

IJITCS

View full text Add to dashboard Cite

Abstract-Crypto ransomware has earned an infamous reputation in the malware landscape and its sound sends a lot of shivers to many despite being a new entrant. The media has not helped matters even as the myths and inaccuracies surrounding crypto ransomware continue to deepen. It's been purported that once crypto ransomware attacks, the victim is left with no option but to pay in order to retrieve the encrypted data, and that without a guarantee, or risk losing the data forever. Security researchers are inadvertently thrown into a cat-and-mouse chase to catch up with the latest vices of the aforesaid in order to provide data resilience. In this paper, we debunk the myths surrounding loss of data via a crypto ransomware attack. Using a variety of crypto ransomware samples, we employ reverse engineering and dynamic analysis to evaluate the underlying attack structures and data deletion techniques employed by the ransomware. Further, we expose the data deletion techniques used by ransomware to prevent data recovery and suggest how such could be countered. From the results, we further present observed sandbox evasion techniques employed by ransomware against both static and dynamic analysis in an effort to obfuscate its operations and subsequently prevent data recovery. Our analyses have led us to the conclusion that no matter how devastating a crypto ransomware attack might appear, the key to data recovery options lies in the underlying attack structure and the implemented data deletion methodology.

show abstract

“…The sandbox is able to work autonomously for an entire day respecting the safety of users by following the guidelines of previous studies such as [28] and [20].…”

Section: Introductionmentioning

confidence: 99%

What's Your Major Threat? On the Differences between the Network Behavior of Targeted and Commodity Malware

Mariconti

Onaolapo

Ross

et al. 2016

2016 11th International Conference on Availability, Reliability and Security (ARES)

View full text Add to dashboard Cite

Abstract-This work uses statistical classification techniques to learn about the different network behavior patterns demonstrated by targeted malware and generic malware. Targeted malware is a recent type of threat, involving bespoke software that has been created to target a specific victim. It is considered a more dangerous threat than generic malware, because a targeted attack can cause more serious damage to the victim. Our work aims to automatically distinguish between the network activity generated by the two types of malware, which then allows samples of malware to be classified as being either targeted or generic. For a network administrator, such knowledge can be important because it assists to understand which threats require particular attention. Because a network administrator usually manages more than an alarm simultaneously, the aim of the work is particularly relevant. We set up a sandbox and infected virtual machines with malware, recording all resulting malware activity on the network. Using the network packets produced by the malware samples, we extract features to classify their behavior. Before performing classification, we carefully analyze the features and the dataset to study all their details and gain a deeper understanding of the malware under study. Our use of statistical classifiers is shown to give excellent results in some cases, where we achieved an accuracy of almost 96% in distinguishing between the two types of malware. We can conclude that the network behaviors of the two types of malicious code are very different.

show abstract

Prudent Practices for Designing Malware Experiments: Status Quo and Outlook

Cited by 169 publications

References 34 publications

Are Your Training Datasets Yet Relevant?

Are Your Training Datasets Yet Relevant?

Towards Data Resilience: The Analytical Case of Crypto Ransomware Data Recovery Techniques

What's Your Major Threat? On the Differences between the Network Behavior of Targeted and Commodity Malware

Contact Info

Product

Resources

About