Abstract:In the late 20th century, computer viruses emerged as powerful malware that resides permanently in target hosts. For a virus to function, it must load into memory from persistent storage, such as a file on a hard drive. Due to the significant destructive potential of viruses, numerous defense measures have been developed to protect computer systems. Among these, antivirus software is one of the most recognized and widely used. Typically, antivirus solutions rely on static analysis (signature-based) technologies to detect infections in files stored on permanent storage devices, such as hard drives or USB (Universal Serial Bus) flash drives. However, a new breed of malware, fileless malware, has been designed to evade detection and enhance durability. Fileless malware resides solely in the memory of the target hosts, circumventing traditional antivirus software, which cannot access or analyze processes executed directly from memory. This study proposes the Check-on-Execution (CoE) kernel-based approach to detect fileless malware on Linux systems. CoE intervenes by suspending code execution before a program executes code from a process's writable and executable memory area. To prevent the execution of fileless malware, CoE extracts the code from memory, packages it with an ELF (Executable and Linkable Format) header to create an ELF file, and uses VirusTotal for analysis. Experimental results demonstrate that CoE significantly enhances a Linux system's ability to defend against fileless malware. Additionally, CoE effectively protects against shell code injection attacks, including buffer and memory overflows, and can handle packed malware. However, it is important to note that this study focuses exclusively on fileless malware, and further research is needed to address other types of malware.

Research of Malicious Code Defense Technology Based on UEFI Firmware

The Research of Malware Prevention Technology Based on UEFI

Firmware Fuzzy Test System Oriented to New Generation Firmware Interface Standard

SoK: Security Below the OS -- A Security Analysis of UEFI

Security Analysis of EFI Framework

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

Defense of Hidden Backdoor Technology for Web

Enhancing Linux System Security: A Kernel-Based Approach to Fileless Malware Detection and Mitigation

BootKeeper: Validating Software Integrity Properties on Boot Firmware Images

UEFI Vulnerability Signature Generation using Static and Symbolic Analysis

Uncovering EDK2 Firmware Flaws: Insights from Code Audit Tools

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode

A survey on the evolution of bootkits attack and defense techniques

A Multi-Core Security Architecture Based On Efi

Dual-core EFI-based Security Architecture

A New Architecture of Sensitive File Management Based on Dual-Core and EFI

A Search-based Firmware Code Analysis Method for IoT Devices

Technique of Detecting Malicious Executables Via Behavioral and Binary Signatures

RESEARCH AND IMPLEMENTATION OF DISK DATA ANALYSIS-BASED STATIC BOOTKIT DETECTION

A scalable cryptographic library for extensible firmware interface

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis