TTAnalyze: A Tool for Analyzing Malware

By Ulrich Bayer, Christopher Krügel, Engin Kirda. 2006

377 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/994d0c4ef7ec40d8fd8e50e3ddbaaa296198ea78

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains (2014, methodology): “Speci.cally, we obtained malicious domains from malwaredomains.com [Domains 2009], the Zeus Block List [List 2009b], Malware Domains List [List 2009a], Anubis [Bayer et al. 2006] reports, a list of domains that are extracted from suspected malicious URLs analyzed by Wepawet [Cova 2013] and Phish”
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis (2011, methodology): “com [19], the Zeus Block List [26], Malware Domains List [25], Anubis [13] reports, a list of domains that are extracted from suspected to be malicious URLs analyzed by Wepawet [18], and Phishtank [31].”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “Some tools [6, 54] provide reports that summarize the activities of unknown programs at the level of Windows API or system calls.”
CopperDroid: Automatic Reconstruction of Android Malware Behaviors (2015, background): “Andrubis [28] is an extension to the Anubis dynamic malware analysis system to analyze Android malware [5], [24].”
Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks (2015, methodology): “The data set is created using multiple sources including manual and automatic crawling of public malware repositories, and the ransomware samples submitted to Anubis [7] since 2011.”
Automatic analysis of malware behavior using machine learning (2011, unknown): “For monitoring the behavior of executable binaries, multiple different methods exist from which the majority is based on the interception of system calls (e.g., [6,7, 14,69]).”
Measuring Pay-per-Install: The Commoditization of Malware Distribution (2011, unknown): “Furthermore, malware analysis platforms that execute malware with Internet connectivity [1, 2, 30] should carefully track program downloads and their execution, to allow separation of each program’s runtime behavior.”
Scalable, Behavior-Based Malware Clustering (2009, methodology): “For this purpose, we have extended ANUBIS, our system for automated, dynamic malware analysis [14].”
Exploring Multiple Execution Paths for Malware Analysis (2007, methodology): “These systems, such as CWSandbox [29], the Norman Sand- Box [25], TTAnalyze [2], or Cobra [28] automatically load the sample to be analyzed into a virtual machine environment and execute it.”
Malware Analysis and Classification: A Survey (2014, methodology): “Several online automated tools exist for dynamic analysis of malwares, e.g. Norman Sandbox [19], CWSandbox [20], Anubis [21] and TTAnalyzer [22], Ether [23] and ThreatExpert [24].”
Large-scale malware classification using random projections and neural networks (2013, methodology): “The API tri-gram and API parameter features are used to analyze the dynamic behavior of the unknown file [6, 7].”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “— Emulator: TTAnalyze [Bayer et al. 2006a] is a QEMU-based dynamic malware analysis framework that monitors Windows API calls and Windows native system calls, as well as function call parameters.”
The Role of Cloud Services in Malicious Software: Trends and Insights (2015, methodology): “Unlike previous work that actively probed public cloud IP addresses [22] or only use passive DNS records [13], we directly collect malware communications by analyzing the network traffic recorded by the Anubis dynamic analysis system [6].”
Analysis of Machine learning Techniques Used in Behavior-Based Malware Detection (2010, methodology): “Binary submission and execution of Anubis result in the generation of a report file.”
ANDRUBIS -- 1,000,000 Apps Later: A View on Current Android Malware Behaviors (2014, methodology): “We built ANDRUBIS as an extension to the dynamic Windows malware analysis sandbox ANUBIS [18] [19].”
Ether: malware analysis via hardware virtualization extensions (2008, methodology): “More recent frameworks [1, 3, 44] and their discrete components [15, 19] attempt to oﬀer or mimic a level of trans-parency analogous to that of a non-instrumented OS running on physical hardware.”
Opcodes as predictor for malware (2007, methodology): “Further static and dynamic malware investigations were undertaken by Chinchani and Berg (2005), Rozinov (2005), Polychronakis et al. (2006), Ries (2005), Bilar (2007) and Bayer et al. (2006), respectively.”