Classification of malware persistence mechanisms using low-artifact disk instrumentation

摘要: The proliferation of malware in recent years has motivated the need for tools to analyze, classify, and understand intrusions. Current research analyzing focuses on labeling as malicious or benign, it with family variant belongs to. We argue that, addition providing coarse labels, is useful label by capabilities they employ. Capabilities can include keystroke logging, downloading a file from internet, modifying Master Boot Record, trojanizing system binary. Unfortunately, capability requires descriptive, high-integrity trace behavior, which challenging given complex stealth techniques that employ order evade analysis detection. In this thesis, we present DIONE, flexible rule-based disk I/O monitoring infrastructure. DIONE interposes between system-under-analysis its hard disk, intercepting accesses reconstructing high-level registry changes occur. evaluate accuracy performance show achieve 100% operations, penalty less than 2% many cases. Given trustworthy behavioral traces obtained convert system-level events capabilities. For this, use model checking, formal verification approach compares extracted specification. Since events, aim persistence capabilities—that is, sample mechanism uses not only persist but restart after boot. Windows service, commonly-employed used persist, load binary reboot, even dangerous code into kernel. installation boot, access service test our models over 1000 real-world samples, successfully identifies service-installing samples 99% time, loads 97% time. Moreover, demonstrate are able reads differentiate two types accesses. detect when installed, also successful because automatic program reboot. correctly identify patterns 4% mislabeled, an expert analyst would have difficulty identifying mislabeled