Title:
Robust and efficient malware analysis and host-based monitoring
Robust and efficient malware analysis and host-based monitoring
| dc.contributor.advisor | Lee, Wenke | |
| dc.contributor.advisor | Giffin, Jonathon | |
| dc.contributor.author | Sharif, Monirul Islam | en_US |
| dc.contributor.committeeMember | Ahamad, Mustaque | |
| dc.contributor.committeeMember | Blough, Douglas | |
| dc.contributor.committeeMember | Pande, Santosh | |
| dc.contributor.department | Computing | en_US |
| dc.date.accessioned | 2011-03-04T20:58:04Z | |
| dc.date.available | 2011-03-04T20:58:04Z | |
| dc.date.issued | 2010-11-15 | en_US |
| dc.description.abstract | Today, host-based malware detection approaches such as antivirus programs are severely lagging in terms of defense against malware. Two important aspects that the overall effectiveness of malware detection depend on are the success of extracting information from malware using malware analysis to generate signatures, and then the success of utilizing these signatures on target hosts with appropriate system monitoring techniques. Today's malware employ a vast array of anti-analysis and anti-monitoring techniques to deter analysis and to neutralize antivirus programs, reducing the overall success of malware detection. In this dissertation, we present a set of practical approaches of robust and efficient malware analysis and system monitoring that can help make malware detection on hosts become more effective. First, we present a framework called Eureka, which efficiently deobfuscates single-pass and multi-pass packed binaries and restores obfuscated API calls, providing a basis for extracting comprehensive information from the malware using further static analysis. Second, we present the formal framework of transparent malware analysis and Ether, a dynamic malware analysis environment based on this framework that provides transparent fine-(single instruction) and coarse-(system call) granularity tracing. Third, we introduce an input-based obfuscation technique that hides trigger-based behavior from any input-oblivious analyzer. Fourth, we present an approach that automatically reverse-engineers the emulator and extracts the syntax and semantics of the bytecode language, which helps constructing control-flow graphs of the bytecode program and enables further analysis on the malicious code. Finally, we present Secure In-VM Monitoring, an approach of efficiently monitoring a target host while being robust against unknown malware that may attempt to neutralize security tools. | en_US |
| dc.description.degree | Ph.D. | en_US |
| dc.identifier.uri | http://hdl.handle.net/1853/37220 | |
| dc.publisher | Georgia Institute of Technology | en_US |
| dc.subject | Obfuscation | en_US |
| dc.subject | System monitoring | en_US |
| dc.subject | Malware analysis | en_US |
| dc.subject | Host-based security | en_US |
| dc.subject.lcsh | Malware (Computer software) | |
| dc.subject.lcsh | Computer viruses | |
| dc.title | Robust and efficient malware analysis and host-based monitoring | en_US |
| dc.type | Text | |
| dc.type.genre | Dissertation | |
| dspace.entity.type | Publication | |
| local.contributor.advisor | Lee, Wenke | |
| local.contributor.corporatename | College of Computing | |
| local.contributor.corporatename | School of Computer Science | |
| relation.isAdvisorOfPublication | c2f2a105-702f-45e4-a8a3-4ca5eb3d0eec | |
| relation.isOrgUnitOfPublication | c8892b3c-8db6-4b7b-a33a-1b67f7db2021 | |
| relation.isOrgUnitOfPublication | 6b42174a-e0e1-40e3-a581-47bed0470a1e |
Files
Original bundle
1 - 1 of 1
- Name:
- sharif_monirul_i_201012_phd.pdf
- Size:
- 5.3 MB
- Format:
- Adobe Portable Document Format
- Description: