Malware Developers Research Articles

DETECTION OF HIDDEN FUNCTIONALITIES OF SMART PHONE MALWARE APP USING PATTERN-MATCHING TECHNIQUES

Malware developers are progressively using advanced techniques to defeat malware detection tools. One such technique commonly observed in recent malware samples consists of hiding and obfuscating modules containing malicious functionality in places that static analysis tools overlook. In this paper, we describe a dynamic analysis approach for detecting such hidden or obfuscated malware components distributed as parts of an app package. The key idea is behavioral differences between the original app and a number of automatically generated versions of it, where a number of modifications (faults) have been carefully injected. The differential signature is analyzed through a pattern-matching process driven by rules that relate different types of hidden functionalities with patterns found in the signature. A thorough justification and a description of the proposed model are provided.

On the use of artificial malicious patterns for android malware detection

Malware programs currently represent the most serious threat to computer information systems. Despite the performed efforts of researchers in this field, detection tools still have limitations for one main reason. Actually, malware developers usually use obfuscation techniques consisting in a set of transformations that make the code and/or its execution difficult to analyze by hindering both manual and automated inspections. These techniques allow the malware to escape the detection tools, and hence to be seen as a benign program. To solve the obfuscation issue, many researchers have proposed to extract frequent Application Programming Interface (API) call sequences from previously encountered malware programs using pattern mining techniques and hence, build a base of fraudulent behaviors. Based on this process, it is worth mentioning that the performance of the detection process heavily depends on the base of examples of malware behaviors; also called malware patterns. In order to deal with this shortcoming, a dynamic detection method called Artificial Malware-based Detection (AMD) is proposed in this paper. AMD makes use of not only extracted malware patterns but also artificially generated ones. The artificial malware patterns are generated using an evolutionary (genetic) algorithm. The latter evolves a population of API call sequences with the aim to find new malware behaviors following a set of well-defined evolution rules. The artificial fraudulent behaviors are subsequently inserted into the base of examples in order to enrich it with unseen malware patterns. The main motivation behind the proposed AMD approach is to diversify the base of malware examples in order to maximize the detection rate. AMD has been tested on different Android malware data sets and compared against recent prominent works using commonly employed performance metrics. The performance analysis of the obtained results shows the merits of our AMD novel approach.

A Real-Time and Adaptive-Learning Malware Detection Method Based on API-Pair Graph

The detection of malware have developed for many years, and the appearance of new machine learning and deep learning techniques have improved the effect of detectors. However, most of current researches have focused on the general features of malware and ignored the development of the malware themselves, so that the features could be useless with the time passed as well as the advance of malware techniques. Besides, the detection methods based on machine learning are mainly static detection and analysis, while the study of real-time detection of malware is relatively rare. In this article, we proposed a new model that could detect malware real-time in principle and learn new features adaptively. Firstly, a new data structure of API-Pair was adopted, and the constructed data was trained with Maximum Entropy model, which could satisfy the goal of weighting and adaptive learning. Then a clustering was practised to filter relatively unrelated and confusing features. Moreover, a detector based on Lont Short Term Memory Network (LSTM) was devised to achieve the goal of real-time detection. Finally, a series of experiments were designed to verify our method. The experimental results showed that our model could obtain the highest accuracy of 99.07% in general tests and keep the accuracies above 97% with the development of malware; the results also proved the feasibility of our model in real-time detection through the simulation experiment, and robustness against a typical adversarial attack.

X64Unpack: Hybrid Emulation Unpacker for 64-bit Windows Environments and Detailed Analysis Results on VMProtect 3.4

In spite of recent remarkable advances in binary code analysis, malware developers are still using complex anti-reversing techniques to make analysis difficult. To protect malware, they use packers, which are (commercial) tools that contain various anti-reverse engineering techniques such as code encryption, anti-debugging, and code virtualization. In this paper, we present x64Unpack: a hybrid emulation scheme that makes it easier to analyze packed executable files and automatically unpacks them in 64-bit Windows environments. The most distinguishable feature of x64Unpack compared to other dynamic analysis tools is that x64Unpack and the target program share virtual memory to support both instruction emulation and direct execution. Emulation runs slow but provides detailed information, whereas direct execution of the code chunk runs very fast and can handle complex cases regarding to operating systems or hardware devices. With x64Unpack, we can monitor major API (Application Programming Interface) function calls or conduct fine-grained analysis at the instruction-level. Furthermore, x64Unpack can detect anti-debugging code chunks, dump memory, and unpack the packed files. To verify the effectiveness of x64Unpack, experiments were conducted on the obfuscation tools: UPX 3.95, MPRESS 2.19, Themida 2.4.6, and VMProtect 3.4. Especially, VMProtect and Themida are considered as some of the most complex commercial packers in 64-bit Windows environments. Experimental results show that x64Unpack correctly emulates the packed executable files and successfully produces the unpacked version. Based on this, we provide the detailed analysis results on the obfuscated executable file that was generated by VMProtect 3.4.

ANALYSIS OF THE PRIMARY TRENDS IN CYBERSECURITY

Open and free cyberspace increases the freedom of people and social communications, in such conditions it becomes especially important to search for new possibilities of ensuring the state security in view of the formation of a new confrontation field - cyberspace. It is important to analyze the actual problems of information security, actions of the world governments and world organizations for identifying the current state of modern trends in the cybersecurity field. Cybersecurity incidents affect the lives of consumers of informational and many other services, and cyberattacks targeting various objects of electronic communications infrastructure or process management. This article covers in detail the factors that influence the state of cybersecurity in the country, its cyberspace and the protection of information objects. The rapid development of malicious software in the world and the lines of action by famous hacker groups are analyzed. The tendencies of active legislative updates in the cybersecurity field of the world’s leading countries, such as creating new structural groups, increasing the number of existing ones and increasing their funding, are identified. The reasons for attackers concentrating their efforts on the search for assets vulnerabilities and the development of a unique multifunctional malware and technologies for unauthorized assets are considered. Structured information about the status of modern trends in the field of cybersecurity and information protection is presented in this article. The situation that has evolved to date with cybercrime requires continuous improvement of cybercrime fighting methods, development of information systems and methods aimed at ensuring the country's cybersecurity. Therefore, the issue of cyberspace security, cybercrime fighting is relevant internationally as well as at the national level and therefore needs further consideration.

Efficient distributed network covert channels for Internet of things environments†

AbstractEach day more and more Internet of Things (IoT) devices are being connected to the Internet. In general, their applications are diverse but from the security perspective, it is evident that they are increasingly targeted by cybercriminals and used for nefarious purposes. Network covert channels form a subgroup of the information-hiding research area where secrets are sent over communication networks embedded within the network traffic. Such techniques can be used, among others, by malware developers to enable confidential data exfiltration or stealth communications. Recently, distributed network covert channels have raised the attention of security professionals as they allow the cloaking of secret transmission by spreading the covert bits among many different types of data-hiding techniques. However, although there are many works dealing with IoT security, little effort so far has been devoted in determining how effective the covert channels threat can be in the IoT henvironments. That is why, in this article, we present an extensive analysis on how distributed network covert channels that utilize network traffic from IoT devices can be used to perform efficient secret communication. More importantly, we do not focus on developing novel data-hiding techniques but, instead, considering the nature of IoT traffic, we investigate how to combine existing covert channels so the resulting data transfer is less visible. Moreover, as another contribution of our work, we prepare and share with the community the network traffic dataset that can be used to develop effective countermeasures against such threats.

Model checking for malicious family detection and phylogenetic analysis in mobile environment

Malware targeting mobile devices is widespread, in fact considering the great amount of sensitive and private information stored in tablets and smartphones they represent an interesting surface attack for malware developers. From the defensive side, the well-known weaknesses of the current anti-malware technologies do not permit only the detection of new obfuscated malicious payloads, but also of obfuscated malware (even with trivial obfuscation techniques applied with automatic morphing engines). In fact, a threat is recognized only if its signature is present in the anti-malware repository and typically the signature extraction consists in a time consuming task performed by security analysts. In this paper we propose a two-fold method aimed to (i) detect the belonging family of a mobile malicious application and (ii) collocate the application in the right position in the phylogenetic tree. We represent application system call traces in terms of automaton and, through the adoption of process mining, we extract temporal logic property verified with the adoption of a formal verification environment. The evaluation on a data-set composed by more than 12,000 Android applications (4552 malicious ranging from 2010 to 2018, 4552 obfuscated with three different obfuscation engines and 3500 legitimate) confirms the effectiveness of the proposed formal methods-based approach, obtaining an accuracy ranging from 0.882 to 0.987 in the analysis of 12 real-world widespread malicious families implementing different behaviours.

The MalSource Dataset: Quantifying Complexity and Code Reuse in Malware Development

During the last decades, the problem of malicious and unwanted software (malware) has surged in numbers and sophistication. Malware plays a key role in most of today's cyber attacks and has consolidated as a commodity in the underground economy. In this work, we analyze the evolution of malware from 1975 to date from a software engineering perspective. We analyze the source code of 456 samples from 428 unique families and obtain measures of their size, code quality, and estimates of the development costs (effort, time, and number of people). Our results suggest an exponential increment of nearly one order of magnitude per decade in aspects such as size and estimated effort, with code quality metrics similar to those of benign software.We also study the extent to which code reuse is present in our dataset. We detect a significant number of code clones across malware families and report which features and functionalities are more commonly shared. Overall, our results support claims about the increasing complexity of malware and its production progressively becoming an industry.

AdDroid: Rule-Based Machine Learning Framework for Android Malware Analysis

Recent years have witnessed huge growth in Android malware development. Colossal reliance on Android applications for day to day working and their massive development dictates for an automated mechanism to distinguish malicious applications from benign ones. A significant amount of research has been devoted to analyzing and mitigating this growing problem; however, attackers are using more complicated techniques to evade detection. This paper proposes a framework, AdDroid; for analyzing and detecting malicious behaviour in Android applications based on various combinations of artefacts called Rules. The artefacts represent actions of an Android application such as connecting to the Internet, uploading a file to a remote server or installing another package on the device etc. AdDroid employs an ensemble-based machine learning technique where Adaboost is combined with traditional classifiers in order to train a model founded on static analysis of Android applications that is capable of recognizing malicious applications. Feature selection and extraction techniques are used to get the most distinguishing Rules. The proposed model is created using a dataset comprising 1420 Android applications with 910 malicious and 510 benign applications. Our proposed system achieved an accuracy of 99.11% with 98.61% True Positive (TP) and 99.33% True Negative (TN) rate. The high TP and TN rates reflect the efficacy on both major and minor class. Since the proposed solution has exceptionally low computational complexity, therefore, making it possible to analyze applications in real-time.

StaDART: Addressing the problem of dynamic code updates in the security analysis of android applications

Dynamic code update techniques (Android Studio – support for dynamic delivery), such as dynamic class loading and reflection, enable Android apps to extend their functionality at runtime. At the same time, these techniques are misused by malware developers to transform a seemingly benign app into a malware, once installed on a real device. Among the corpus of evasive techniques used in modern real-world malware, evasive usage of dynamic code updates plays a key role.First, we demonstrate the ineffectiveness of existing tools to analyze apps in the presence of dynamic code updates using our test apps, i.e., Reflection-Bench and InboxArchiver. Second, we present StaDART, combining static and dynamic analysis of Android apps to reveal the concealed behavior of malware. StaDART performs dynamic code interposition using a vtable tampering technique for API hooking to avoid modifications to the Android framework. Furthermore, we integrate it with a triggering solution, DroidBot, to make it more scalable and fully automated. We present our evaluation results with a dataset of 2000 real world apps; containing 1000 legitimate apps and 1000 malware samples. The evaluation results with this dataset and Reflection-Bench show that StaDART reveals suspicious behavior that is otherwise hidden to static analysis tools.

A Survey on Mobile Security Issues

In today`s world of advanced science the world is changing, so is our technology. Smart- phones have become crucial part of day to day life. The increased use of smart-phones has given rise to ways we could never think like easy accessibility to net, work or personal information. But with it comes to the risk of security issues like compromised privacy or unauthorized accesses to mobile phones etc, to name some the unique structure makes easy target for malware developers and Hackers. Android for example has a very few restrictions so there is very less security system for end users. So the first target should be to eliminate these security breaches and give users the smooth experience without worrying about these problems. The paper addresses the problems faced with mobile security and how to overcome them. The paper also presents a brief description about what kind of operating system is much more at risk of these attacks and, which is more prone to security breach. It also consists of what fields still need to be researched on as to move forward in better direction. Furthermore, it explains the working of wireless systems and the attacks on it by hackers and how can that be prevented. Lastly it also illustrates about the attacks by hackers, types of attacks done on mobile phones and other related wireless systems and how to prevent them, and what users can do to prevent themselves by these attacks.

Permission-based Android Malware Detection System Using Feature Selection with Genetic Algorithm

As the use of smartphones increases, Android, as a Linux-based open source mobile operating system (OS), has become the most popular mobile OS in time. Due to the widespread use of Android, malware developers mostly target Android devices and users. Malware detection systems to be developed for Android devices are important for this reason. Machine learning methods are being increasingly used for detection and analysis of Android malware. This study presents a method for detecting Android malware using feature selection with genetic algorithm (GA). Three different classifier methods with different feature subsets that were selected using GA were implemented for detecting and analyzing Android malware comparatively. A combination of Support Vector Machines and a GA yielded the best accuracy result of 98.45% with the 16 selected permissions using the dataset of 1740 samples consisting of 1119 malwares and 621 benign samples.

A Detailed Study on Advanced Persistent Threats: A Sophisticated Threat

In the present world computer networks are used to store sensitive information and to provide services for organizations and society. The growth of internet and the increased use of computers in society along with smart devices lead to the increase in cyber crimes and persistent attacks. The most complex and advanced attacks are targeted attacks which are specifically aimed at companies or governments to accomplish the predetermined goals such as economic advantages, strategic benefits, getting control of sensitive information. Hackers try to access sensitive data from cyber space and there by become as advanced malware developers for the security systems. One type of such attack is Advanced Persistent Threats (APT) which targets the governmental institutions, military, multinational enterprises, financial industry, manufacturing and banks. The approach that is followed by the attackers are repeated attempts using different methods such as , stealth approach, adapting to the existing defense mechanisms, stealthily infiltrating the network to avoid any suspicions like involving in sleep modes before commencing any attack. The effects of these attacks are ex-filtration of key intelligence property, stoppage of fundamental services, and destruction of critical infrastructure. This paper is about the detailed study of Advanced Persistent threats to provide an idea about the advanced attacks.

Detection of malicious and low throughput data exfiltration over the DNS protocol

In the presence of security countermeasures, a malware designed for data exfiltration must use a covert channel to achieve its goal. The Domain Name System (DNS) protocol is a covert channel commonly used by malware developers today for this purpose. Although the detection of covert channels using the DNS has been studied for the past decade, prior research has largely dealt with a specific subclass of covert channels, namely DNS tunneling. While the importance of tunneling detection should not be minimized, an entire class of low throughput DNS exfiltration malware has been overlooked. In this study, we propose a method for detecting both tunneling and low throughput data exfiltration over the DNS. After determining that previously detected malware used Internet domains that were registered for a cyber-campaign rather than compromising existing legitimate domains, we focus on detecting and denying requests to these domains as an effective data leakage shutdown. Therefore, our proposed solution handles streaming DNS traffic in order to detect and automatically deny requests to domains that are used for data exchange. The initial data collection phase collects DNS logs per domain in a manner that permits scanning for long periods of time, and is thus capable of dealing with “low and slow” attacks. In the second phase features are extracted based on the querying behavior of each domain, and in the last phase an anomaly detection model is used to classify domains based on their use for data exfiltration. With regard to detection, DNS requests to domains that were classified as being used for data exfiltration will be denied indefinitely. Our method was evaluated on a large-scale recursive DNS server’s logs with a peaking high of 47 million requests per hour. Within these DNS logs, we injected data exfiltration traffic from DNS tunneling tools as well as two real-life malware: FrameworkPOS, previously used for the theft of 56M credit cards from Home Depot in 2014, and Backdoor.Win32.Denis, which was active in the Cobalt Kitty APT in 2016. Even when restricting our method to an extremely low false positive rate (i.e., one in fifty thousand domains), it detected all of the above. In addition, the logs are used to compare our system with two recently published methods that focus on detecting DNS tunneling in order to stress the novelty of detecting low throughput exfiltration malware.

Malware Collusion Attack against SVM: Issues and Countermeasures

Android has become the most popular mobile platform, and a hot target for malware developers. At the same time, researchers have come up with numerous ways to deal with malware. Among them, machine learning based methods are quite effective in Android malware detection, the accuracy of which can be as high as 98%. Thus, malware developers have the incentives to develop more advanced malware to evade detection. This paper presents an adversary attack scenario (Collusion Attack) that will compromise current machine learning based malware detection methods, especially Support Vector Machines (SVM). The malware developers can perform this attack easily by splitting malicious payload into two or more apps. Meanwhile, attackers may hide their malicious behavior by using advanced techniques (Evasion Attack), such as obfuscation, etc. According to our simulation, 87.4% of apps can evade Linear SVM by Collusion Attack. When performing Collusion and Evasion Attack simultaneously, the evasion rate can reach 100% at a low cost. Thus, we proposed a method to deal with this issue. This approach, realized in a tool, called ColluDroid, can identify the collusion apps by analyzing the communication between apps. In addition, it can integrate secure learning methods (e.g., Sec-SVM) to fight against Evasion Attack. The evaluation results show that ColluDroid is effective in finding out the collusion apps and ColluDroid-Sec-SVM has the best performance in the presence of both Collusion and Evasion Attack.

Anomaly‐based exploratory analysis and detection of exploits in android mediaserver

Smartphone platforms are becoming increasingly complex, which gives way to software vulnerabilities difficult to identify and that might allow malware developers to gain unauthorised privileges through technical exploitation. However, the authors maintain that these types of attacks indirectly renders a number of unexpected behaviours in the system that can be profiled. In this work, the authors present CoME , an anomaly-based methodology aiming at detecting software exploitation in Android systems. CoME models the normal behaviour of a given software component or service and it is capable of identifying any unanticipated behaviour. To this end, they first monitor the normal operation of a given exploitable component through lightweight virtual introspection. Then, they use a multivariate analysis approach to estimate the normality model and detect anomalies. They evaluate their system against one of the most critical vulnerable and widely exploited services in Android, i.e. the mediaserver. Results show that the proposed approach can not only provide a meaningful explanatory of discriminant features for illegitimate activities, but can also be used to accurately detect malicious software exploitations at runtime.

Entropy-based security risk measurement for Android mobile applications

Android as a widest used operating system for smartphones and mobile devices uses permissions to restrict malicious applications (apps). However, malware developers use various social engineering methods to entice users for installing malwares after granting critical permissions by users. Therefore, it is essential to estimate security risks of untrusted Android apps to help users for making better decisions regarding app selection and installation. In this paper, the concept of criticality for Android permissions is precisely defined according to the abuse of permissions by known malwares and their legal usage by useful apps. Based on this definition and analyzing requested permissions of large numbers of malwares and benign apps, a new criterion is proposed to measure the security risks of the apps. This measure benefits from the concepts of entropy and information gain of permissions regarding separating malwares from benign apps. In this criterion, more informative permissions have higher impacts on the computed risk values. In order to evaluate the proposed criterion, two new datasets of recent malicious and non-malicious Android apps have been constructed and analyzed against existing ones. This analysis shows that permission usage patterns of Android apps are changed over the time. Empirical evaluations on recent and previous malwares and benign apps reveal the superiority of the proposed criterion with respect to previously proposed ones in terms of assigning larger risk values to malwares.

Who Watches the Watchmen

Malicious software, a threat users face on a daily basis, have evolved from simple bankers based on social engineering to advanced persistent threats. Recent research and discoveries reveal that malware developers have been using a wide range of anti-analysis and evasion techniques, in-memory attacks, and system subversion, including BIOS and hypervisors. In addition, code-reuse attacks like Returned Oriented Programming emerge as highly potential remote code execution threats. To counteract the broadness of malicious codes, distinct techniques and tools have been proposed, such as transparent malware tracers, system-wide debuggers, live forensics tools, and isolated execution rings. In this work, we present a survey on state-of-the-art techniques that detect, mitigate, and analyze the aforementioned attacks. We show approaches based on Hardware Virtual Machines introspection, System Management Mode instrumentation, Hardware Performance Counters, isolated rings (e.g., Software Guard eXtensions), as well as others based on external hardware. We also discuss upcoming threats based on the very same technologies used for defense. Our main goal is to provide the reader with a broader, more comprehensive understanding of recently surfaced tools and techniques aiming at binary analysis for modern platforms.

A hybrid-multi filter-wrapper framework to identify run-time behaviour for fast malware detection

Malicious software (malware) constitute one of the most pressing cyber threats intended to cripple critical infrastructure, render infected systems unusable, permanently erase data from storage systems. The number of malware has skyrocketed through the use of enormous malware development toolkit. Run-time analysis has recently been used to overcome the limitations of current detection engines due to code obfuscation techniques such as polymorphism and metamorphism. However run-time approaches face a critical challenge of processing a large number of run-time malware features which may fail to provide real time protection. In this paper, we propose a hybrid framework by using more than one complementary filters and a wrapper feature selection approach to identify the most significant run-time behavioural characteristics of malware. The novelty of the proposed framework is that it exploits the complementary characteristics of within-filters and between wrapper-filters by hybridizing discriminant, minimum redundant, and maximum relevant filters with the wrapper approach to integrate the knowledge from the intrinsic characteristics of the run-time behaviour of malware obtained by the filters into the wrapper selection process. We have verified the performance of the proposed approach through extensive experiments using large real malware datasets. The results of the experiments show that the proposed framework finds the most significant run-time characteristics of malware. When these are used in the detection engine, the computational performances and detection accuracies are also improved up to 99.499% compared to any existing techniques.

A Large-Scale Study of Android Malware Development Phenomenon on Public Malware Submission and Scanning Platform

With the steady growth of Android malware, we suspect that, during the malware development phase, some Android malware writers use the popular public scanning services (e.g., VirusTotal) for testing the evasion capability of their malware samples, which we name Android malware development cases (AMDs). In this work, we design an AMD hunter in the context of VirusTotal to hunt for AMDs and reveal new threats for Android. First, the AMD hunter sifts through millions of file submissions on VirusTotal efficiently and alert more suspicious submission traces. Second, it performs package level analysis, static code and dynamic analyses on the APKs of the suspicious submissions to validate the AMDs. The implemented hunter has been used in a leading security company for 4 months, which processed 153 million of submissions on VirusTotal, and identified 1,623 AMDs with 13,855 samples from 83 countries. We also performed case studies on 890 malware samples selected from the identified AMDs, which revealed lots of new threats, including the development cases of fake system/banking phishing app, new rooting exploits, new JavaScript based threats, new evasions and AV probing malware. We wrote industry research articles about some AMDs and notified other security vendors to help patch their false negatives. Besides raising the awareness of the existence of AMDs, more importantly, our research provides the first systematic and efficient way to study the malware development phenomenon on VirusTotal. We will share all the samples of the identified AMDs with the research community.