Abstract:The escalating sophistication of cyber-attacks and the widespread utilization of stealth tactics have led to significant security threats globally. Nevertheless, the existing static detection methods exhibit limited coverage, and traditional dynamic monitoring approaches encounter challenges in bypassing evasion techniques. Thus, it has become imperative to implement nuanced and dynamic analysis to achieve precise behavior detection in real time. There are two pressing concerns associated with current dynamic malware behavior detection solutions. Firstly, the collection and processing of data entail a significant amount of overhead, making it challenging to be employed for real-time detection on the end host. Secondly, these approaches tend to treat malware as a singular entity, thereby overlooking varied behaviors within one instance. To fill these gaps, we propose PARIS, an adaptive trace fetching, lightweight, real-time malicious behavior detection system. Specifically, we monitor malicious behavior with Event Tracing for Windows (ETW) and learn to selectively collect maliciousness-related APIs or call stacks, significantly reducing the data collection overhead. As a result, we can monitor a wider range of APIs and detect more intricate attack behavior. We implemented a prototype of PARIS and evaluated the system overhead, the accuracy of comparative behavior recognition, and the impact of different models and parameters. The result demonstrates that PARIS can reduce over 98.8 compared to the raw ETW trace and hence decreases the overhead on the host in terms of memory, bandwidth, and CPU usage with a similar detection accuracy to the baselines that suffer from the high overhead. Furthermore, a breakdown evaluation shows that 80 reduction in CPU usage can be attributed to our adaptive trace-fetching collector.

Pinky: A Modern Malware-oriented Dynamic Information Retrieval Tool

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

Dynamic Analysis of Malicious Code

The Reversing Machine: Reconstructing Memory Assumptions

Reviving Android Malware with DroidRide: and How Not To.

Malware Sight-Seeing: Accelerating Reverse-Engineering via Point-of-Interest-Beacons

Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware

A Framework for Understanding Dynamic Anti-Analysis Defenses.

A Look at the Dark Side of Hardware Reverse Engineering -- A Case Study

Malicious cryptography techniques for unreversable (malicious or not) binaries

Malware Profiler Based on Innovative Behavior-Awareness Technique

Tutorial: An Overview of Malware Detection and Evasion Techniques

Malware Dynamic Analysis Evasion Techniques: A Survey

Dynamic Analysis and Debugging of Binary Code for Security Applications

Towards Generic Deobfuscation of Windows API Calls

HAL—The Missing Piece of the Puzzle for Hardware Reverse Engineering, Trojan Detection and Insertion

PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System

Fakeium: A Dynamic Execution Environment for JavaScript Program Analysis

TPE-Det: A Tamper-Proof External Detector via Hardware Traces Analysis Against IoT Malware

MicroWalk: A Framework for Finding Side Channels in Binaries

Detile: Fine-Grained Information Leak Detection in Script Engines