Toward Automated Dynamic Malware Analysis Using CWSandbox

By Carsten Willems, Thorsten Holz, Felix C. Freiling. 2007

828 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection (2013, methodology): “MalOffice uses pdftk3 to extract JavaScript code, and CWSandbox [41] to analyze the code behavior: code classi.cation is carried out by a set of rules.”
Malware Analysis and Classification: A Survey (2014, methodology): “Several online automated tools exist for dynamic analysis of malwares, e.g. Norman Sandbox [19], CWSandbox [20], Anubis [21] and TTAnalyzer [22], Ether [23] and ThreatExpert [24].”
PlatPal: Detecting Malicious Documents with Platform Diversity (2017, methodology): “This is in contrast with traditional sandboxed malware analysis such as Cuckoo [44] or CWSandbox [63], which executes the malware and examines its behavior and influence on the host operating system during runtime.”
AppsPlayground: automatic security analysis of smartphone applications (2013, background): “CWSandbox [29] and Botlab [12] study malware behavior in monitored environments.”
Ether: malware analysis via hardware virtualization extensions (2008, methodology): “Approaches that employ these ideas to obtain scalability include malware analysis services such as Norman Sandbox [13], CWSandbox [47] and Anubis [1].”
Mobile-sandbox: having a deeper look into android applications (2013, background): “This is a common problem in Windows-based dynamic analysis [25].”
A Pattern Recognition System for Malicious PDF Files Detection (2012, background): “CWSandbox [14] is a sophisticated platform capable to extract the dynamic behavior of a computer system once a certain (e.”
An Android Application Sandbox system for suspicious software detection (2010, methodology): “CWSandbox [34] or Java sandboxes [12], but especially smartphone platforms lack such kind of analysing software2.”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “For example, Detours [Hunt and Brubacher 1998] is a dynamic instrumentation tool that can detect Windows APIs invoked by a malware sample, and CWSandbox [Willems et al. 2007] monitors Windows API calls by the malware by performing API hooking and DLL injection.”
CopperDroid: Automatic Reconstruction of Android Malware Behaviors (2015, background): “Tracking system call invocations is at the basis of virtually all dynamic malware behavioral analysis systems [24], [27], [41].”
Effective and Efficient Malware Detection at the End Host (2009, background): “Some tools [6, 54] provide reports that summarize the activities of unknown programs at the level of Windows API or system calls.”
Novel Feature Extraction, Selection and Fusion for Effective Malware Family Classification (2015, methodology): “are variants is concerned, the need for the automation of this process is clear-cut. The analysis of malicious programs is usually carried out by static techniques [39, 48, 34] and dynamic techniques [45, 37, 9, 46]. Analyzers extract various characteristics from the programs’ syntax and semantic su”
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey (2019, methodology): “CWSandbox [58] is based on code injection of a trusted DLL into the analyzed process, which intercepts function calls by overwriting entries in the Export Address Table (EAT) and redirecting execution to CWSandbox .”