Towards an understanding of anti-virtualization and anti-debugging behavior in modern malware

By Xu Chen, Jonathon Andersen, Z. Morley Mao, Michael Bailey, Jose Nazario. Dependable Systems and Networks, 2008

332 citations recorded by the source corpus.

Many threats that plague todaypsilas networks (e.g., phishing, botnets, denial of service attacks) are enabled by a complex ecosystem of attack programs commonly called malware. To combat these threats, defenders of these networks have turned to the collection, analysis, and reverse engineering of malware as mechanisms to understand these programs, generate signatures, and facilitate cleanup of infected hosts. Recently however, new malware instances have emerged with the capability to check and often thwart these defensive activities - essentially leaving defenders blind to their activities. To combat this emerging threat, we have undertaken a robust analysis of current malware and developed a detailed taxonomy of malware defender fingerprinting methods. We demonstrate the utility of this taxonomy by using it to characterize the prevalence of these avoidance methods, to generate a novel fingerprinting method that can assist malware propagation, and to create an effective new technique to protect production systems.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/c02eb235de15b47591aad03ebbe2dac36a84a05c

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

MARVIN: Efficient and Comprehensive Mobile App Classification through Static and Dynamic Analysis (2015, background): “Possibilities reach from iterating certain device properties to reveal the underlying virtualization technology, to exploiting specific properties of emulated code within virtual machines to detect analysis environments [48,49,63].”
Comprehensive Analysis and Detection of Flash-Based Malware (2016, background): “Experience has shown that successful analysis systems have repeatedly been subject to dedicated evasion techniques of various types [10].”
Security issues in cloud environments: a survey (2014, methodology): “[46] have thoroughly characterized the prevalence of malware evasion methods by executing 6,900 malware samples under different environments.”
Automatic analysis of malware behavior using machine learning (2011, unknown): “Common evasion techniques include mimicry attacks [18,30,68] and attacks against the analysis system [10,63].”
CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Furthermore, recent research has shown that evading signature detection is possible with relative ease when the malware signatures used are too rigid [9], [24], [32], [33].”
Cloud security issues and challenges: A survey (2017, background): “Malware Avoidance of malware Spreading of malware onto VMs Metamorphic engines [33] [145] [149] [180] [84] [152] Intrusion prevention system [187]”