Resilient Dynamic Analysis for Windows Malware Technique Discovery against Behavior Obfuscation

PurposeManagers of megaprojects face social risk management challenges throughout the various design, construction, and operation stages, owing to the various conflicts of interest among stakeholders, public skepticism, and opposition. However, most existing studies have not focused on the dynamic analysis of integrating social risks in these stages. This study developed a dynamic analysis approach to explore the dynamics of critical social risk factors and related stakeholders of megaprojects and built the managerial maps for various stakeholders.Design/methodology/approachBased on the social analysis network (SNA), a dynamic network analysis approach for understanding the dynamics of social risk and related stakeholders has been developed by literature and case analysis. The approach comprises the following steps: (1) generating social risk–stakeholder networks in different stages; (2) analysis of the critical stakeholders and social risk factors; (3) dynamic analysis of social risk factors; and (4) developing social risk management maps for various stakeholders. To verify the feasibility and effectiveness of the approach, 40 megaprojects from China were analyzed.FindingsAccording to the results, the local government is a critical stakeholder during all stages, inadequate information promotion (IIP) and imperfect communication and coordination mechanism (ICCM) are key social risk sources throughout the megaproject life cycle. Furthermore, the management maps for government organizations, project implementation groups, and external stakeholders were constructed.Originality/valueThis research has three contributions. First, a dynamic analysis approach of stakeholder-associated social risks in megaprojects is developed, which enriches the social risk management theory of megaprojects and provides inspiration for future research focus. Second, the social risk–stakeholder networks and critical social risks in different stages are confirmed to provide a more valid and accurate picture of social risk management in megaprojects. Third, the social risk managerial maps for different stakeholders built in this research will be beneficial for governments, project implementation groups, and external stakeholders to optimize management strategies.

The continuing fight against intentionally malicious software has, to date, favoured the proliferators of malware. Signature detection methods are growingly impotent against rapidly evolving obfuscation techniques. Research has recently focussed on the low-level opcode analysis of disassembled executable programs, both statically and dynamically. While able to detect malware, static analysis often still cannot unravel obfuscated code; dynamic approaches allow investigators to reveal the run-time code. Old and inadequately sampled datasets have limited the extrapolation potential of much of the body of research. This work presents a dynamic opcode analysis approach to malware detection, applying machine learning techniques to the largest dataset of its kind, both in terms of breadth (610–100k features) and depth (48k samples). N-gram analysis of opcode sequences from n = 1. . 3 was applied as a means of enhancing the feature set. Feature selection was then investigated to tackle the feature explosion which resulted in more than 100,000 features in some cases. As the earliest detection of malware is the most favourable, run-length, i.e. the number of recorded opcodes in a trace, was examined to find the optimal capture size. This research found that dynamic opcode analysis can detect malware from benignware with a 99.01% accuracy rate, using a sequence of only 32k opcodes and 50 features. This demonstrates that a dynamic opcode analysis approach can compare with static analysis in terms of speed. Furthermore, it has a very real potential application to the unending fight against malware, which is, by definition, continuously on the back foot.

Privacy and security flaws in apps are commonly detected by static and dynamic analysis approaches. However, the realistic impact rating for detected flaws is often limited. Static approaches lack runtime information and dynamic analysis miss program structure information. We aim to build a dynamic analysis environment and rate the flaw impact based on the data flow context. We correlate the traced API call chains with data sources and sinks of processed information. This way, the actual runtime information is used and program structures for significant data flows can be reconstructed. Therefore, this publication proposes a method for collecting execution traces based on automated function hooking and mechanisms to create and analyze data flow graphs from these traces. We demonstrate the scalability of our privacy and security analysis by automatically analyzing and evaluating the top 1000 free apps from Google Play. Manual app analysis and damn vulnerable app projects prove the high quality results of our automated approach during evaluation.

The popularity of aerial work platforms is rapidly increasing in the mechanization industry. As a result, the safety and structural strength of aerial work platforms should be prioritized.In this study, the mathematical model of a reconstructed aerial work platform was developed and a 3D model was created using the Solidworks software. A dynamic analysis was then performed to improve various structural parameters of the aerial work platform. The analysis was carried out using solid modelling, finite elements, and dynamic transient analysis. In compliance with international structural standards, the weight distribution was reconstructed after placing a mass behind the turret.The results of the dynamic transient analysis were compared with the mathematical model and validated. Then, the effect of the mass placed behind the turret on the machine was examined. The lateral tipping distance of the static work platform was found to have increased from 15.9m to 17.08 m. The structure of the aerial work platform was improved using a structural and dynamic analysis approach. It was also discovered that the machine efficiency could be further increased by ensuring that the balancing weight is moved further away from the tower centre by a hydraulic-based system and controller.

Dynamic program analysis is a long-standing technique for obtaining information about program execution. We present module recontextualization, a new dynamic analysis approach that targets modern dynamic languages such as JavaScript and Racket, enabled by the fact that they feature a module-import mechanism that loads code at runtime as a string. This approach uses lightweight load-time code transformations that operate on the string representation of the module, as well as the context to which it is about to be bound, to insert developer-provided, analysis-specific code into the module before it is loaded. This code implements the dynamic analysis, enabling this approach to capture all interactions around the module in unmodified production language runtime environments. We implement this approach in two systems targeting the JavaScript and Racket ecosystems. Our evaluation shows that this approach can deliver order-of-magnitude performance improvements over state-of-the-art dynamic analysis systems while supporting a range of analyses, implemented on average in about 100 lines of code.

While increasing the threat of malware for information systems, researchers strive to find alternative malware detection methods based on static, dynamic and hybrid analysis. Due to obfuscation techniques to bypass the static analysis, dynamic methods become more useful to detect malware. Therefore, most of the researches focus on dynamic behavior analysis of malicious software. In this work, our main objective is to find more discriminative dynamic features to detect malware executables by analyzing different dynamic features with common malware detection approaches. Moreover, we analyze separately different features obtained in dynamic analysis, such as API-call, usage system library and operations, to observe the contributions of these features to malware detection and classification success. For this purpose, we evaluate the performance of some dynamic feature-based malware detection and classification approaches using four data sets that contain real and synthetic malware executables.

Dynamic modeling and analysis of a large-scale hoop-column antenna using the referenced nodal coordinate formulation

This work used a new dynamic approach in which wafer-level chip-scale packages (WLCSP) were first aged by applying various current levels and then detailed measurements were taken to study the failure mechanism of these packages. The aging stage involved various accelerated current stressing conditions at a fixed ambient temperature of 125 °C. Unlike previous studies, all of which ran the aging process to the point where failure occurred, our experiment halted the aging stage after a sufficient amount of time to allow us to carefully investigate the failure mechanism in detail. The experimental results show that different levels of stressing currents have different effects on the reliability characteristics of the tested WLCSP packages. This work shows that the dynamic analysis approach is effective in studying the mechanism of WLCSP failure and related reliability characteristics.

Potential Evapotranspiration (PET) plays a crucial role in water management, including irrigation systems design and management. It is an essential input to hydrological models. Direct measurement of PET is difficult, time-consuming and costly, therefore a number of different methods are used to compute this variable. This study compares the two sensitivity analysis approaches generally used for PET impact assessment on hydrological model performance. We conducted the study in the Upper Benue River Basin (UBRB) located in northern Cameroon using two lumped-conceptual rainfall-runoff models and nineteen PET estimation methods. A Monte-Carlo procedure was implemented to calibrate the hydrological models for each PET input while considering similar objective functions. Although there were notable differences between PET estimation methods, the hydrological models performance was satisfactory for each PET input in the calibration and validation periods. The optimized model parameters were significantly affected by the PET-inputs, especially the parameter responsible to transform PET into actual ET. The hydrological models performance was insensitive to the PET input using a dynamic sensitivity approach, while he was significantly affected using a static sensitivity approach. This means that the over-or under-estimation of PET is compensated by the model parameters during the model recalibration. The model performance was insensitive to the rescaling PET input for both dynamic and static sensitivities approaches. These results demonstrate that the effect of PET input to model performance is necessarily dependent on the sensitivity analysis approach used and suggest that the dynamic approach is more effective for hydrological modeling perspectives.

Escape analysis can determine whether and when a variable becomes shared for multiple threads, which is a foundation for many other program analyses. Most existing escape analysis tools are either purely dynamic or static analysis. Static analysis usually considers all possible behaviors of a program, however, may produce false positives; whereas dynamic approaches can not analyze unobserved behaviors of a program. This paper presents a hybrid approach that integrates static and dynamic analyses to address this problem. We first perform static analysis to obtain summaries of accesses to potential escaped variables. When the program runs, dynamic analysis is used to confirm variable sharing; for unexecuted code, we determine the sharing of variables in it by performing an interprocedural static analysis based on the runtime information. Compared to dynamic analysis, the hybrid approach is able to determine the escape property of variables in unexecuted code. Compared to static analysis, the hybrid approach produces fewer false alarms. We implemented this hybrid escape analysis in Java. Our experimental evaluation on several benchmarks and real-world applications shows that it has improved accuracy compared to existing approaches and can also boost the performance of subsequent program analyses significantly.

Static and dynamic sensitivity analysis of corrosion product activity in primary coolant circuits of pressurized water reactors

Concurrency programs are hard to test or debug due to their non-deterministic nature. Existing dynamic program analysis approaches tried to address this by carefully examine a recorded execution trace. However, developing such analysis tools is complicated, requiring to take care of many tedious implementation details, and comparing and evaluating different analysis approaches are also subject to various biases, due to lack of a common base platform. This motivates us to design DPAC, an infrastructure that support in building dynamic program analysis tools for concurrency Java programs. DPAC takes events and their various processing mechanisms as its underlying model to facilitate monitoring and manipulation of program executions as required by dynamic program analysis. Various analysis tools can be implemented by customizing their required event types and processing mechanisms. We show two concrete case studies how our DPAC helps building existing dynamic program analysis approaches, as well as tuning subtle implementation details for supporting customized function implementation and code transformation.

Due to an increase in the number of Android malware applications and their diversity, it has become necessary for the security community to develop automated dynamic analysis systems. Static analysis has its limitations that can be overcome by dynamic analysis. Many tools based on dynamic analysis approach have been developed which employ emulated/virtualized environment for analysis. While it has been an effective technique for analysis, it can be espied and evaded by recent sophisticated malware. Malware families such as Pincer, AnserverBot, BgServ, Wroba have incorporated methods to check the presence of emulated or virtualized environment. Once the presence of the sandbox is detected, they do not execute any malicious behavior. In this paper, a robust emulated environment has been proposed and developed that is resilient against most of the detection techniques. We have compared our malware analysis tool DroidAnalyst against 12 publicly available dynamic analysis services and shown that our service is best when considering resilience against anti-emulation techniques. Incorporation of anti anti-detection techniques in the dynamic analysis that are purely based on emulation hinders the detection and evasion of emulated environment by malware.

The main goal of this chapter is to propose a simplified procedure to accomplish the dynamic analysis of pre-cast RC (reinforced concrete) telecommunication towers subjected to wind loads. With the methodology proposed here, only the static results and the first natural frequency of vibration are needed to accomplish the dynamic analysis of a given structure. The method is easier and faster than the traditional dynamic analysis approach. In this work, results of the dynamic and static analysis of 90 real structures are used in the optimization process. The difference between the results given by the simplified method proposed here and the complete dynamic analysis are less than 2 %.

Vertical distribution of equivalent static loads for base isolated building structures