Efficient dynamic malware analysis using virtual time control mechanics

Chih-Hung Lin

doi:10.1016/j.cose.2017.11.010

Efficient dynamic malware analysis using virtual time control mechanics

2018-03-01

33

PRE

AI

DOI：10.1016/j.cose.2017.11.010

Original

Original request for help

Save

Abstract

En 中文

Efficient detection of stealthy malware attacks in suspicious files is very challenging as dynamic malware analysis is time consuming. This paper proposes a virtual time control mechanics based method to overcome the challenge. The proposed method utilizes a modified Xen hypervisor, in which a virtual clock source is generated according to a predefined speed ratio, such that sandbox systems running on the modified hypervisor can be accelerated. Thus, it does not modify operating system kernels nor intercept system function calls, and is therefore compatible with various operating systems. Further, it utilizes an entropy-based measure that adjusts its execution time according to various malware inputs as an early termination criterion. The results of experiments conducted to verify the efficacy of the proposed method indicate that it speeds up the system timer and significantly increases the logged record size by up to 42% or obtains the same log size within a shorter period compared with conventional sandboxes. Thus, the proposed virtual time control mechanics-based method efficiently detects nontrivial anomalous codes that may be neglected by conventional sandboxing techniques. (C) 2017 Elsevier Ltd. All rights reserved.

Keywords:

Dynamic analysis

Virtual time control

Information entropy

Anti-analysis

Hypervisor

Efficient dynamic malware analysis using virtual time control mechanics

Abstract

AI Summary

Journal

Organization