Context-Aware Malicious Code Detection
Saved in:
| Title: | Context-Aware Malicious Code Detection |
|---|---|
| Authors: | Gu, Boxuan |
| Advisors: | Xuan, Dong |
| Summary: | Malicious codes are one of the biggest threats on the Internet according to the US-CERT vulnerability database. One salient example is Conficker, a malicious code targeting MS Windows that was released in 2009. Before it was discovered, millions ofcomputers on the Internet were infected. Manyapproaches to malicious code detection have been proposed. However, such approaches have a key weakness: they do not leverage contextinformation from target systems and input data in order to performdetection. Malicious codes can fully utilize context information for attack purposes, thereby evading detection. To address this issue, wepropose a methodology that leverages such context information for malicious code detection. Based on this methodology, we design andimplement three detection systems for malicious code detection on servers, Web browsers, and smartphones. Our first system takes ``snapshots'' of a target process's virtual memory space and leveragesthese snapshots to reveal malicious codes' true behaviors when consuming input data. Based on the first system, we construct thesecond system, which leverages Web browsers' JavaScript code execution environment to detect malicious JavaScript codes that exploitbrowsers' memory errors. Our third system uses an information flow tracking mechanism to detect malicious codes that steal sensitiveinformation stored in smartphones. We comprehensively evaluate these detection systems with many real-world malicious codes. Our experimental results indicate that the context information can be usedto greatly improve detection effectiveness with reasonable overhead. |
| URL: | http://rave.ohiolink.edu/etdc/view?acc_num=osu1354523604 |
| Database: | OpenDissertations |
| Abstract: | Malicious codes are one of the biggest threats on the Internet according to the US-CERT vulnerability database. One salient example is Conficker, a malicious code targeting MS Windows that was released in 2009. Before it was discovered, millions ofcomputers on the Internet were infected. Manyapproaches to malicious code detection have been proposed. However, such approaches have a key weakness: they do not leverage contextinformation from target systems and input data in order to performdetection. Malicious codes can fully utilize context information for attack purposes, thereby evading detection. To address this issue, wepropose a methodology that leverages such context information for malicious code detection. Based on this methodology, we design andimplement three detection systems for malicious code detection on servers, Web browsers, and smartphones. Our first system takes ``snapshots'' of a target process's virtual memory space and leveragesthese snapshots to reveal malicious codes' true behaviors when consuming input data. Based on the first system, we construct thesecond system, which leverages Web browsers' JavaScript code execution environment to detect malicious JavaScript codes that exploitbrowsers' memory errors. Our third system uses an information flow tracking mechanism to detect malicious codes that steal sensitiveinformation stored in smartphones. We comprehensively evaluate these detection systems with many real-world malicious codes. Our experimental results indicate that the context information can be usedto greatly improve detection effectiveness with reasonable overhead. |
|---|
