Abstract:In the late 20th century, computer viruses emerged as powerful malware that resides permanently in target hosts. For a virus to function, it must load into memory from persistent storage, such as a file on a hard drive. Due to the significant destructive potential of viruses, numerous defense measures have been developed to protect computer systems. Among these, antivirus software is one of the most recognized and widely used. Typically, antivirus solutions rely on static analysis (signature-based) technologies to detect infections in files stored on permanent storage devices, such as hard drives or USB (Universal Serial Bus) flash drives. However, a new breed of malware, fileless malware, has been designed to evade detection and enhance durability. Fileless malware resides solely in the memory of the target hosts, circumventing traditional antivirus software, which cannot access or analyze processes executed directly from memory. This study proposes the Check-on-Execution (CoE) kernel-based approach to detect fileless malware on Linux systems. CoE intervenes by suspending code execution before a program executes code from a process's writable and executable memory area. To prevent the execution of fileless malware, CoE extracts the code from memory, packages it with an ELF (Executable and Linkable Format) header to create an ELF file, and uses VirusTotal for analysis. Experimental results demonstrate that CoE significantly enhances a Linux system's ability to defend against fileless malware. Additionally, CoE effectively protects against shell code injection attacks, including buffer and memory overflows, and can handle packed malware. However, it is important to note that this study focuses exclusively on fileless malware, and further research is needed to address other types of malware.

Polymorphic Shellcode Detection System Based on Dynamic Emulation

Dynamic Emulation Based Modeling and Detection of Polymorphic Shellcode at the Network Level.

Method of Shellcode Detection Based on Static and Dynamic Mechanism

SBE '—' A Precise Shellcode Detection Engine Based on Emulation and Support Vector Machine

Apply NIDS Technology to Detect Polymorphic Shellcode Evading

A Novel Hybrid Method for Polymorphic Worm Detection

A Hybrid Detection Approach For Zero-Day Polymorphic Shellcodes

Detecting Encryption Functions Via Process Emulation and IL-based Program Analysis

A FEATURE SELECTION AND MODELLING METHOD FOR MALICIOUS CODE

Overeview on Malicious Code Shelling

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Dynamic Detection of Unknown Malicious Executables Base on API Interception

Malicious Code Detection Method Based on Static Features and Ensemble Learning

Design and Implementation of an Automated Malware Dynamic Analysis System

A method for hidden malcode anomaly detection using dynamic control-flow analysis

Implicit-Flow-Sensitive Method for Detection of Trojan-Spy Programs

Approach of Binary Code Analysis Based on Full-System Emulation and Instruction-Flow Analysis

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

Pinicorn: Towards Automated Dynamic Analysis for Unpacking 32-Bit PE Malware

Enhancing Linux System Security: A Kernel-Based Approach to Fileless Malware Detection and Mitigation

Component Similarity Based Methods for Automatic Analysis of Malicious Executables