.png){kind=icon}
Return
Efficient dynamic malware analysis using virtual time control mechanics
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2017.11.010.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Efficient detection of stealthy malware attacks in suspicious files is very challenging as dynamic malware analysis is time consuming. This paper proposes a virtual time control mechanics based method to overcome the challenge. The proposed method utilizes a modified Xen hypervisor, in which a virtual clock source is generated according to a predefined speed ratio, such that sandbox systems running on the modified hypervisor can be accelerated. Thus, it does not modify operating system kernels nor intercept system function calls, and is therefore compatible with various operating systems. Further, it utilizes an entropy-based measure that adjusts its execution time according to various malware inputs as an early termination criterion. The results of experiments conducted to verify the efficacy of the proposed method indicate that it speeds up the system timer and significantly increases the logged record size by up to 42% or obtains the same log size within a shorter period compared with conventional sandboxes. Thus, the proposed virtual time control mechanics-based method efficiently detects nontrivial anomalous codes that may be neglected by conventional sandboxing techniques. (C) 2017 Elsevier Ltd. All rights reserved.
Keywords:
Dynamic analysis
Virtual time control
Information entropy
Anti-analysis
Hypervisor
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W
Organization
Cited Papers
ShareSaveShareSaveShareSaveShareSaveShareSaveShareSaveShareSaveA set of robust fluorescent peptide probes for quantification of Cu(ii) binding affinities in the micromolar to femtomolar range.png)
Metallomics
OAAI
MetallomicsIF0
OAAIShareSaveMobile Loops and Electrostatic Interactions Maintain the Flexible Tail Tube of Bacteriophage LambdaOAAI
OAAIShareSaveShareSave
View more