Abstract:Run-time behavior of processes – running on an end-host – is being actively used to dynamically detect malware. Most of these detection schemes build model of run-time behavior of a process on the basis of its data flow and/or sequence of system calls. These novel techniques have shown promising results but an efficient and effective technique must meet the following performance metrics: (1) high detection accuracy, (2) low false alarm rate, (3) small detection time, and (4) the technique should be resilient to run-time evasion attempts.To meet these challenges, a novel concept of genetic footprint is proposed, by mining the information in the kernel process control blocks (PCB) of a process, that can be used to detect malicious processes at run time. The genetic footprint consists of selected parameters – maintained inside the PCB of a kernel for each running process – that define the semantics and behavior of an executing process. A systematic forensic study of the execution traces of benign and malware processes is performed to identify discriminatory parameters of a PCB (task_struct is PCB in case of Linux OS). As a result, 16 out of 118 task structure parameters are short listed using the time series analysis. A statistical analysis is done to corroborate the features of the genetic footprint and to select suitable machine learning classifiers to detect malware.The scheme has been evaluated on a dataset that consists of 105 benign processes and 114 recently collected malware processes for Linux. The results of experiments show that the presented scheme achieves a detection accuracy of 96% with 0% false alarm rate in less than 100ms of the start of a malicious activity. Last but not least, the presented technique utilizes partial knowledge that is available at a given time while the process is still executing; as a result, the kernel of OS can devise mitigation strategies. It is also shown that the presented technique is robust to well known run-time evasion attempts.

Detecting and bypassing frida dynamic function call tracing: exploitation and mitigation

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

In-execution dynamic malware analysis and detection by mining information in process control blocks of Linux OS

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

WarpAttack: Bypassing CFI through Compiler-Introduced Double-Fetches

Bypassing memory safety mechanisms through speculative control flow hijacks

Runtime Code Reuse Attacks: A Dynamic Framework Bypassing Fine-Grained Address Space Layout Randomization.

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

A Framework for Understanding Dynamic Anti-Analysis Defenses.

Efficient And Practical Control Flow Monitoring For Program Security

Towards Vulnerability Discovery Using Staged Program Analysis

POSTER : PT-DBG : Bypass Anti-debugging with Intel Processor Tracing

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

Malware Dynamic Analysis Evasion Techniques: A Survey

Catch You with Cache: Out-of-VM Introspection to Trace Malicious Executions.

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

Tutorial: An Overview of Malware Detection and Evasion Techniques

KALD : Detecting Direct Pointer Disclosure Vulnerabilities

Proactive Vulnerability Finding Via Information Flow Tracking

Hardware-Assisted Fine-Grained Code-Reuse Attack Detection.

Rampo: A CEGAR-based Integration of Binary Code Analysis and System Falsification for Cyber-Kinetic Vulnerability Detection