Panorama: capturing system-wide information flow for malware detection and analysis

By Heng Yin, Dawn Song, Manuel Egele, Christopher Krügel, Engin Kirda. Conference on Computer and Communications Security, 2007

840 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/565570f136733d79337de8f28ebf8839f8e185d0

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

All Your iFRAMEs Point to Us (2008, background): “Lastly, malware detection via dynamic tainting analysis may provide deeper insight into the mechanisms by which malware installs itself and how it operates [8, 13, 24].”
A Study of Android Application Security (2011, background): “Panaorama [47] considers privacy-breaching malware in general using wholesystem, fine-grained taint tracking.”
Lares: An Architecture for Secure Active Monitoring Using Virtualization (2008, methodology): “Taint-based malware analysis systems, such as Panorama [ 40 ], require the monitoring of individual instructions to be able to trace memory reads and writes.”
“Andromaly”: a behavioral malware detection framework for android devices (2012, methodology): “Systems such as Panorama (Yin et al. 2007) and the BHO Spyware Taint Analyzer (Egele et al. 2007) demonstrate the feasibility of dynamic methods by capturing suspicious information access patterns and processing behaviors (i.e., information flow analysis) that are common to different types of malwar”
A Survey on Advanced Persistent Threats: Techniques, Solutions, Challenges, and Research Opportunities (2019, background): “The authors of the paper [33] have portrayed the characteristics of different types of malware, and proposed a solution ‘Panorama’ that will detect these different types of malware.”
Scalable, Behavior-Based Malware Clustering (2009, methodology): “This is different from previous systems, which either operate on the system call interface [25, 39] or perform whole-system taint analy sis [46].”
DTA++: Dynamic Taint Analysis with Targeted Control-Flow Propagation (2011, methodology): “Our technique first diagnoses implicit flows within information-preserving transformations, where they are most likely to cause undertainting.”
Privacy oracle: a system for finding application leaks with black box differential testing (2008, methodology): “Categories and Subject Descriptors D.2.5 [SOFTWARE ENGINEERING]: Testing and Debugging General Terms Experimentation, Security Keywords Personal information leaks, Black-box testing, Sequence alignment algorithm, Differential fuzz testing, Data loss prevention”
Ether: malware analysis via hardware virtualization extensions (2008, background): “, Polyglot [23] and Panorama [48]), Siren [22] and others.”
Insights into User Behavior in Dealing with Internet Attacks (2012, neutral): “, [16, 39, 62]), cross-site scripting (e.”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “A number of specialized analysis tools [Caballero et al. 2007; Kang et al. 2007; Yin et al. 2007] have been built on top of TEMU.”
CAMP: Content-Agnostic Malware Protection (2013, background): “Logically, the boolean circuit can be separated into three different parts: the site aggregates, the IP aggregates andthe unknown aggregates.”
DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis (2012, methodology): “The taint tracker incurs 11x to 34x slowdown, which is comparable to other taint analysis tools [10, 39] on the x86 architecture.”
Polyglot: automatic extraction of protocol message format using dynamic binary analysis (2007, background): “The first phase is implemented by thexecution monitor [37].”