Ether: malware analysis via hardware virtualization extensions

By Artem Dinaburg, Paul Royal, Monirul I. Sharif, Wenke Lee. Conference on Computer and Communications Security, 2008

783 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/cec86c66b88d213541e0dca2baead32d1b3074e8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Effective Intrusion Detection System Using XGBoost (2018, methodology): “There are many tools available such as Ether [4] (a framework designed to do malware analysis, leveraging hardware virtualization extensions to remain hidden from malicious software), that help in performing this task from outside the VM.”
A Survey on Malware Detection Using Data Mining Techniques (2017, methodology): “Finally, Ether [Dinaburg et al. 2008] is a debugging tool leveraging hardware virtualization extensions such as Intel VT [Intel 2013] to remain invisible to the malware.”
A survey on automated dynamic malware-analysis techniques and tools (2012, methodology): “The system presented by Egele et al. [2007] is able to dynamically analyze spyware that is installed as a browser plug-in to the Microsoft Internet Explorer.”
Mining on Someone Else's Dime: Mitigating Covert Mining Operations in Clouds and Enterprises (2017, background): “To mitigate these concerns, researchers have proposed various Virtual Machine Introspection (VMI) approaches [36,42,45].”
kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, methodology): “Another, somewhat more old-fashioned, method to achieve the same is to use shadow page tables [19].”
überSpark: Enforcing Verifiable Object Abstractions for Automated Compositional Security Analysis of a Hypervisor (2016, background): “Hypervisors not only enable the old-hat style of customization, such as modularity for device drivers, but are further extended with convenient functionality for security services such as attestation, debugging, tracing, application-level integrity and confidentiality, trustworthy resource accountin”
Classification of malware using structured control flow (2010, methodology): “A virtual machine approach to unpacking using x86 hardware extensions was proposed in Ether (Dinaburg et al. 2008).”
Malware Analysis and Classification: A Survey (2014, methodology): “A modified version of Ether malware analysis framework [23] is used to collect data.”
Building a Dynamic Reputation System for DNS (2010, background): “Our honeypot infrastructure is similar to “Ether” [4] and is capable of processing malware samples in a queue.”
Graph-based malware detection using dynamic analysis (2011, methodology): “For our research, we use a modified version of the Ether Malware Analysis framework [12] to perform the data collection.”
BitShred: feature hashing malware for scalable triage and semantic analysis (2011, background): “Our work builds on per-sample analysis and feature extraction, which is an extremely active area of research including unpacking research [18, 20, 27, 33, 35], and even entire conferences like DIMVA.”
Automatic analysis of malware behavior using machine learning (2011, neutral): “For monitoring the behavior of executable binaries, multiple different methods exist from which the majority is based on the interception of system calls (e.g., [6,7, 14,69]).”
DUET: integration of dynamic and static analyses for malware clustering with cluster ensembles (2013, background): “Countermeasures include use of more transparent environments [8, 9], detecting split identities of malware samples [5] and forcing multiple path exploration [26].”
A comparison of static, dynamic, and hybrid analysis for malware detection (2015, methodology): “However, for the datasets considered in this paper, we found no significant differences in the API call sequences generated by BSA and Ether.”