Automated Extraction of Network Activity From Memory Resident Code

Domain Generation Algorithms (DGA) is a basic building block used in almost all modern malware. Malware researchers have attempted to tackle the DGA problem with various tools and techniques, with varying degrees of success. We present a complex solution to populate DGA feed using reversed DGAs, third-party feeds, and a smart DGA extraction and clustering based on emulation of a large number of samples. Smart DGA extraction requires no reverse engineering and works regardless of the DGA type or initialization vector, while enabling a cluster-based analysis. Our method also automatically allows analysis of the whole malware family, specific campaign, etc. We present our system and demonstrate its abilities on more than 20 malware families. This includes showing connections between different campaigns, as well as comparing results. Most importantly, we discuss how to utilize the outcome of the analysis to create smarter protections against similar malware.

Malware detection is a problem that has become particularly challenging over the last decade. A common strategy for detecting malware is to scan network traffic for malicious connections between infected devices and their command and control (C&C) servers. However, malware developers are aware of this detection method and begin to incorporate new strategies to go unnoticed. In particular, they generate domain names instead of using static Internet Protocol addresses or regular domain names pointing to their C&C servers. By using a domain generation algorithm, the effectiveness of the blacklisting of domains is reduced, as the large number of domain names that must be blocked greatly increases the size of the blacklist. In this paper, we study different Long Short-Term Memory neural network hyperparameters to find the best network configuration for algorithmically generated domain name detection. In particular, we focus on determining whether the (complex) feature engineering efforts required when using other deep learning techniques, such as Random Forests, can be avoided. In this regard, we have conducted a comparative analysis to study the effect of using different network sizes and configurations on network performance metrics. Our results show an accuracy of 97.62% and an area under the receiver operating characteristic curve of 0.9956 in the test dataset, indicating that it is possible to obtain good classification results despite avoiding the feature engineering process and additional readjustments required in other machine learning techniques.

The complexity of the Regin malware underlines the importance of reverse engineering in modern incident response. The present study shows that such complexity can be overcome: substantial information about adversary tactics, techniques and procedures is obtained from reverse engineering. An introduction to the Regin development framework is provided along with instrumentation guidelines. Such instrumentation enables experimentation with malware modules. So analysis can derectly leverage malware’s own code without the need to program an analysis toolkit. As an application of the presented instrumentation, the underlying botnet architecture is analysed. Finally conclusions from different perspectives are provided: defense, attack and counter intelligence.

Increased usage of websites serves information gathering over the Internet, which exponentially increases the rate of download. Almost anything of interest, anyone can undoubtedly search and download from the web, which also leads to download the malicious code unknowingly, i.e., malwares. Everything that corrupts the PC or system is referred to as a virus without knowing what it accomplishes but comes under the bigger umbrella of malware. This chapter systematically introduces malware, its types, needs, and prerequisites for malware analysis. Malware is a fast-growing threat to the modern computing world, and there does not exist an ideal solution to tackle it. Its growth is the exponential increase of Internet uses with various services such as social networks and cloud storage. Malware rapidly multiplies itself over the Internet, and sometimes it leads to a major attack, for instance, a botnet attack and others. Antiviruses are the protection software from malware and act as a line of defense. However, this line of defense is not that effective as many of them are still using a signature-based approach, and malware developers have knowledge about this. They modify their malware accordingly, and hence, malware gets a sneaky entrance into the computers. Therefore, there is a constant need for a behavior-based or heuristic-based approach to address different malware families. Machine learning and reverse engineering are the best techniques to fight malware, and many researchers are persistently working on many problems of malware attacks. Therefore, this chapter highlights all the available existing approaches for malware detection and its analysis like static and dynamic analysis to get to know the functioning of malware to remove it from attacked personal computers (PCs) or systems.

Memory forensics and data carving methods are usually used during volatile investigation and is nowadays a big area of interest. Volatile memory dump is used for offline analysis of live data. Live analysis of the running system gives the information of which events are going on. Volatile memory analysis can give the sensitive information such as User Ids, Passwords, Hidden Processes, Root kits, Sockets etc. which are not stored on the physical drive. This Paper represents various approaches and tools used to capture and analyse data from computer memory.

Instant Messengers become an important means of communication. Millions of people. regardless of age, nationality, gender and computer skills, spend a lot of time using them every day. Thus, Social networks already occupied the place of traditional messaging systems of the past. More and more communications are migrating from public chat rooms and private messengers into online Social Networking Sites (SNSs). As cybercrimes mushroom in recent years, more and more digital crime investigations have strong relations to these SNSs. Communications extracted from SNSs can be extremely valuable and useful to all kinds of investigators including forensic investigators. We now apply the spotlight on distinct strings specific to each SNSs and volatile memory analysis and display of any case detail as a key to a successful digital investigation through rapid & improved retrieval performance.

For the rapidly development of network and distributed computing environment, it make researchers harder to do analysis examines only from one or few pieces of data source in persistent data-oriented approaches, so as the volatile memory analysis either. Therefore, mass data automatically analysis and action modeling needs to be considered for reporting entire network attack process. To model multiple volatile data sources situation can help understand and describe both thinking process of investigator and possible action step for attacker. This paper presents a Game model for multisource volatile data and applies it to main memory images analysis with the definition of space-time feature for volatile element information. Abstract modeling allows the lessons gleaned in performing intelligent analysis, evidence filing and automating presentation. Finally, a test demo based on the model is also present to illustrate the whole procedure

Although the perimeter security model works well enough when all internal hosts are credible, it is becoming increasingly difficult to enforce as companies adopt mobile and cloud technologies, i.e., the rise of bring your own device (BYOD). It is observed that advanced targeted cyber-attacks usually follow a cyber kill chain; for instance, advanced targeted attacks often rely on network scanning techniques to gather information about potential targets. In response to this attack method, we propose a novel approach, i.e., an “isolating and dynamic” cyber defense, which cuts these potential chains to reduce the cumulative availability of the gathered information. First, we build a zero-trust network environment through network isolation, and then multiple network properties are maneuvered so that the host characteristics and locations needed to identify vulnerabilities cannot be located. Second, we propose a software-defined proactive cyber defense solution (SPD) for enterprise networks and design a general framework to strategically maneuver the IP address, network port, domain name, and path, while limiting the performance impact on the benign network user. Third, we implement our SPD proof-of-concept system over a software-defined network controller (OpenDaylight). Finally, we build an experimental platform to verify the system’s ability to prevent scanning, eavesdropping, and denial-of-service attacks. The results suggest that our system can significantly reduce the availability of network reconnaissance scan information, block network eavesdropping, and sharply increase the cost of cyber-attacks.

Over the last few years, computers and smartphones have become essential tools in our ways of communicating with each-other. Nowadays, the amount of applications in the Google store has grown exponentially, therefore, malware developers have introduced malicious applications in that market. The Android system uses the Dalvik virtual machine. Through reverse engineering, we may be able to get the different opcodes for each application. For this reason, in this paper an approach to detect malware on Android is presented, by using the techniques of reverse engineering and putting an emphasis on operational codes used for these applications. After obtaining these opcodes, machine learning techniques are used to classify apps.

EmuID: Detecting presence of emulation through microarchitectural characteristic on ARM

Modern Android malware changes rapidly, making it hard for traditional anti-malware methods to identify these new, disguised and flexible threats. Because existing solutions have issues with many false positives, difficulty handling several types of malware and slow reaction times, hence the work introduce TriSentry-MD as a novel framework for detecting malware in an efficient manner in real time with greater more accurately. The proposed work main breakthrough is achieved by incorporating three different yet matching techniques: GrayCodeNet, to image the resultant bytecode and examine it with convolutional neural networks and a novel BehavWatch-X, which perform normalization and aggregate execution into behaviour feature vector that monitor run time metrics includes CPU usage, battery consumption, network activity, and system calls. Along with proposed ReVersaLearn, a technique for reverse-engineering and using app metadata in classification. Thus, it starts with getting an APK, dividing it into static analysis, bytecode analysis and testing its behaviour in a virtual sandbox. The implementation outputs are gathered and turned into a final outcome by the soft voting process. With harmless attacks from Drebin and AMD, TriSentry-MD obtained near-perfect detection accuracy and almost no false alarms. The findings demonstrate that using Manuscript Click here to access/download;Manuscript;Manuscript.docx multiple data types in a unified framework is effective for discovering a wider variety of android threats and making threat detection more accurate and stronger.

Recently, as various detection approaches of malicious domains and malware are proposed, the malware which connects to its command and control (C&C) server using techniques like domain flux can be identified effectively. Therefore, cybercriminals seek new alternative methods and discover that DNS based on blockchains can be used to connect C&C servers. Because of the distributed ledger technology, domain names resolved by blockchain DNS, called blockchain domain names (BDNs), are of inherent anonymity and censorship-resistance. We analyzed the work mechanism of this new type of malware. In order to detect malicious BDNs, we propose a prototype system, named Leopard, which analyzes DNS traffic patterns and resource records of BDNs. To our best knowledge, we are the first to propose the automatic detection of malicious BDNs. In Leopard, we extracted 17 features from collected traffic and distinguished between malicious BDNs and domains operated by generic and country-code top-level domains registries from the Alexa top 5000 using a random forest model. In our experiments, we evaluate Leopard on a nine-day real-world dataset. The experimental results show that Leopard can effectively detect malicious BDNs with an AUC of 0.9980 and discover 286 unknown malicious BDNs from the dataset.

Chapter 1 - Intrusion Detection Systems

Remote attestation (RA) is a security mechanism that verifies the trustworthiness of remote IoT devices. Traditional RA protocols aim to detect the presence of malicious code in the static memory of a device. In the IoT domain, RA research is currently following two main directions: Dynamic RA and Swarm RA. Dynamic RA schemes intend to detect runtime attacks that hijack the control-flow execution of a running program without injecting new malicious code into the memory. On the other hand, swarm RA protocols focus on attesting efficiently and effectively a large number of IoT devices. However, existing RA protocols do not perform dynamic attestation in asynchronous IoT networks. This paper proposes a RA protocol for Asynchronous Remote Control-Flow Attestation of Distributed IoT Services (ARCADIS). This protocol extends the state-of-the-art by detecting IoT devices that have (directly or indirectly) been maliciously influenced by runtime attacks on asynchronous distributed IoT services. The protocol has been simulated for Wismote sensors in the Contiki emulator. The conducted experiments confirm the feasibility of ARCADIS and demonstrate its practicality for small IoT networks.

The article defines an approach to solving the task of network traffic analysis in higher education establishments (HEE) with the aim of detecting information security threats (IST) to systems, services, and networks. The approach implies using a machine learning model which utilizes neural network technology to classify running network activity as normal or abnormal, the two predetermined classes. In order to determine initial data for teaching and testing the machine learning model a specific approach was designed. The approach implies determination of a local network element, installation of necessary software, network analysis under the circumstances of normal network activity, network analysis under the circumstances of abnormal network activity, data processing and formation of a representative teaching selection.