Extracting Sent Message Formats from Executables Using Backward Slicing

To handle the growing flood of malware, security vendors and analysts rely on tools that automatically identify and analyze malicious code. Current systems for automated malware analysis typically follow a dynamic approach, executing an unknown program in a controlled environment (sandbox) and recording its runtime behavior. Since dynamic analysis platforms directly run malicious code, they are resilient to popular malware defense techniques such as packing and code obfuscation. Unfortunately, in many cases, only a small subset of all possible malicious behaviors is observed within the short time frame that a malware sample is executed. To mitigate this issue, previous work introduced techniques such as multipath or forced execution to increase the coverage of dynamic malware analysis. Unfortunately, using these techniques is potentially expensive, as the number of paths that require analysis can grow exponentially. In this paper, we propose REANIMATOR, a novel solution to determine the capabilities (malicious functionality) of malware programs. Our solution is based on the insight that we can leverage behavior observed while dynamically executing a specific malware sample to identify similar functionality in other programs. More precisely, when we observe malicious actions during dynamic analysis, we automatically extract and model the parts of the malware binary that are responsible for this behavior. We then leverage these models to check whether similar code is present in other samples. This allows us to statically identify dormant functionality (functionality that is not observed during dynamic analysis) in malicious programs. We evaluate our approach on thousands of realworld malware samples, and we show that our system is successful in identifying additional, malicious functionality. As a result, our approach can significantly improve the coverage of malware analysis results.

Facing the surge in malicious behaviors in the network environment, the existing cybersecurity knowledge graph suffers from fragmented security knowledge and limited application scenarios, making it challenging to collaborative malicious behavior analysis. To address this, we propose a cybersecurity behavior knowledge base (CSBKB) framework for comprehensive malicious behavior analysis. Based on knowledge of user behavior, attack traffic, and attack paths, we construct six types of knowledge graphs to characterize malicious behavior, including user behavior perception, user behavior mapping, malicious behavior association, malicious behavior category, domain attack, and malicious behavior path traceability graph. These graphs characterize malicious behaviors and form a comprehensive security behavior knowledge base. To fully utilize the graph structure information, we design a reasoning module based on the graph neural network further to explore the relationship between entities in the graph. Using DDoS attacks as a case study, we demonstrate this framework's construction and knowledge-reasoning capabilities. Experimental results demonstrate that the proposed CSBKB framework effectively realizes a comprehensive malicious behavior analysis mechanism encompassing "malicious user behavior monitoring, malicious behavior type detection, and malicious behavior path tracing." It can effectively analyze malicious behaviors, with an accuracy of more than 0.97 in detecting abnormal users, more than 0.97 in inferring DDoS attack types, and an identification rate of more than 0.92 for malicious behavior paths.

Malware detectors require a specification of malicious behavior. Typically, these specifications are manually constructed by investigating known malware. We present an automatic technique to overcome this laborious manual process. Our technique derives such a specification by comparing the execution behavior of a known malware against the execution behaviors of a set of benign programs. In other words, we mine the malicious behavior present in a known malware that is not present in a set of benign programs. The output of our algorithm can be used by malware detectors to detect malware variants. Since our algorithm provides a succinct description of malicious behavior present in a malware, it can also be used by security analysts for understanding the malware. We have implemented a prototype based on our algorithm and tested it on several malware programs. Experimental results obtained from our prototype indicate that our algorithm is effective in extracting malicious behaviors that can be used to detect malware variants.

Device-to-device (D2D) communications can effectively offload the traffic of cellular system in a distributed way. However, during the data forwarding process, malicious D2D users can intermittently discard data of other users, which seriously affects the data forwarding efficiency. Therefore, a malicious-forwarding-behavior-aware link selection mechanism (MBLS) is proposed in this paper to alleviate the influence of malicious attacks. User behaviors are analyzed according to the correlation between the social relationship and forwarding behavior of users, and the identification of malicious behavior is obtained by Elman neural network. Thus, malicious users can be detected, and then the optimal link can be selected. The simulation results show that the proposed mechanism can effectively detect the malicious behaviors of D2D users, notably improve the reliability of data transmission and significantly enhance the network performance.

For remote malicious code injection attacks, the analysis of injected code behavior has always been the difficulty of malicious code dynamic analysis. In this paper, a remote code injection behavior analysis method based on code refactoring was proposed. By analyzing the behavior of remote code injection attack, extracting the injection behavior pattern rules, analyzing the malicious code by using the dynamic binary analysis platform, identifying the remote injection behavior in the execution process, obtaining the remote injected malicious data, then refactoring and executing the injected code, and finally triggering the hidden behavior of injected code, this method improves the integrity of malicious code behavior analysis. A series of malicious code samples were also used for experimental analysis. And the results showed that this method can obtain more comprehensive behavior information for malicious code with remote injection, and effectively improve the integrity of malicious code analysis.

The malicious code on the network is increasingly rampant that the traditional detection method of characteristic code has been difficult to deal with malicious code, with features of various variants, deformations and other problems. In this paper we present a new static analysis model based on software fingerprint to distinguish malicious codes. Through obtaining the software call graph by disassembling the binary file and mapping it as an image, shape moments can be obtained as the software fingerprint based on the retrieval theory of content image, combined with moment theory and the image's color, texture and shape features. The idea of pattern matching is used to measure the extracted software fingerprint similarity to determine whether it is malicious code or not. Then, we analyze the collected program samples. Test and verify whether the program has good performance in uniqueness, invariability and sensibility. With the rapid popularization of Internet and corporate information technology acceleration, the computer is a great convenience to people's lives, whether it is shopping, leisure or work and more obvious the importance of the Internet, but due to the openness of the Internet and flexible application and operating system vulnerability so that people can enjoy the benefits brought by the computer at the same time, also is experiencing distress and abuse of all kinds of malicious code threats to network security events increased year by year. Network security incidents, the most serious harm caused by malicious code, causing huge economic losses to the country as a whole, society and the individual, information security has become a major challenge facing. Domestic and foreign researchers turned to the semantics of malicious code, trying to judge the signatures of the two deformation malicious code through the instruction-level semantics rather than program syntax, further can determine whether the deformation of the malicious code. Trying to evade detection of malicious code, malicious codes are disassembled and for standardization or stack analysis system call for the use of fuzzy transformation technology to discriminate. In recent years, the researchers also uses malicious code detection technology engineering methodology, based on feature detection based on the application of malicious code detection technology based on data mining and machine learning. However, while foreign research scholars during the malicious code detection and anti-virus software R & D, the attacker malicious code using anti-debugging techniques, anti-Hook technology, to detect whether the code being debugged, the to find themselves debugger or analysis environment, malicious code using fuzzy transform technique and a series of anti-debugging measures show some non-anomalous behavior of the code, so as to protect their own purposes. In this process, we need manually assistive technology. Most automated virus analysis software only to capture some of the behavior, security experts need further analysis and screening of experimental results, and finally determine the extent of the harm of malicious behavior. In summary, the malicious code on the network more and more rampant code detection method for the traditional characteristics of difficult to deal with malicious code variants, deformation problem, solve the problem of the detection of unstable deformation caused due to malicious code upgrade has become a research focus and difficulty, but also of the issues that must be resolved key issues.

The proliferation of malicious users on social platforms poses significant financial and psychological threats, with activities ranging from scams to the dissemination of illicit content. Existing malicious user prediction comprises supervised and self-supervised learning methods. However, the former relies on extensive labeled malicious users for training, while the latter typically focuses on one form of malicious activity and depends heavily on manually crafted rules and features during pre-training. Moreover, existing pre-training methods fail to effectively capture the crucial repetitive and sporadic behavior patterns of malicious users. To address these limitations, we propose a Malicious User Behavior Pre-training framework (MaP) to build pre-trained behavior models. MaP integrates malicious pattern recognition with behavior consistency augmentation and local disruption augmentation strategies for contrastive learning to capture repetitive and sporadic malicious patterns, respectively. We instantiate MaP on a billion-level behavior pre-training scenario within an industry context. Both online and offline evaluations validate the superior performance of MaP in malicious user detection and classification.

Malicious JavaScript code is widely used for exploiting vulnerabilities in web browsers and infecting users with malicious software. Static detection methods fail to protect from this threat, as they are unable to cope with the complexity and dynamics of interpreted code. In contrast, the dynamic analysis of JavaScript code at run-time has proven to be effective in identifying malicious behavior. During the execution of the code, however, damage may already take place and thus an early detection is critical for effective protection. In this paper, we introduce EarlyBird: a detection method optimized for early identification of malicious behavior in JavaScript code. The method uses machine learning techniques for jointly optimizing the accuracy and the time of detection. In an evaluation with hundreds of real attacks, EarlyBird precisely identifies malicious behavior while limiting the amount of malicious code that is executed by a factor of 2 (43%) on average.

In order to thwart dynamic analysis and bypass protection mechanisms, malware have been using several file formats and evasive techniques. While publicly available dynamic malware analysis systems are one of the main sources of information for researchers, security analysts and incident response professionals, they are unable to cope with all types of threats. Therefore, it is difficult to gather information from public systems about CPL, .NET/Mono, 64-bits, reboot-dependent, or malware targeting systems newer than Windows XP, which result in a lack of understanding about how current malware behave during infections on modern operating systems. In this paper, we discuss the challenges and issues faced during the development of this type of analysis system, mainly due to security features available in NT 6.x kernel versions of Windows OS. We also introduce a dynamic analysis system that addresses the aforementioned types of malware as well as present results obtained from their analyses.

Behavior detection of malicious software is better than signature-based detection method when used to find unknown malicious software. The paper presents a classification method of malicious software behavior detection with hybrid set based feed forward neural network. We choose malicious software detection database for test with 57345 records from National Anti-Computer Intrusion and Anti-Virus Research Center. According to the definition of selected data set relations and transfer functions, the weighted path length trees of malicious software detection data are calculated for neural network input vectors. After repeat training, different malicious software detection methods can be classified by the method with the about 83.9 percent right classification.KeywordsNeural NetworkMalicious SoftwareSetIDSBehavior Detection

The article presents a new set-theoretic model and procedures that reduce the time required to detect hidden vulnerabilities in the source code of multi-threaded computer programs, as well as the results of mathematical modeling. Hidden vulnerabilities in the article are under-stood as vulnerabilities leading to data races and deadlocks, since they have a stochastic nature of manifestation during testing, which greatly complicates their identification. The presented model describes the state of each thread of a multi-threaded computer program currently exe-cuting a function and the contents of the function call stack. At the same time, it remains pos-sible to use the model in verification by the Model Checking method, and also eliminates the need to solve the problem of searching for the model invariant. The presented procedures make it possible to formulate specifications for the verification method on models, the implementa-tion of which makes it possible to identify vulnerabilities leading to data races and deadlocks in the source code of multithreaded programs

<p>Malicious code threatens the safety of computer systems. Researching malicious code design techniques and mastering code behavior patterns are the basic work of network security prevention. With the game of network offense and defense, malicious code shows the characteristics of invisibility, polymorphism, and multi-dismutation. How to correctly and effectively understand malicious code and extract the key malicious features is the main goal of malicious code detection technology. As an important method of program understanding, program slicing is used to analyze the program code by using the idea of “decomposition”, and then extract the code fragments that the analyst is interested in. In recent years, data mining and machine learning techniques have been applied to the field of malicious code detection. The reason why it has become the focus of research is that it can use data mining to dig out meaningful patterns from a large amount of existing code data. Machine learning can It helps to summarize the identification knowledge of known malicious code, so as to conduct similarity search and help find unknown malicious code. The machine learning heuristic malicious code detection method firstly needs to automatically or manually extract the structure, function and behavior characteristics of the malicious code, so we can first slice the malicious code and then perform the detection. Through the improvement of the classic program slicing algorithm, this paper effectively improves the slicing problem between binary code processes. At the same time, it implements a malicious code detection system. The machine code byte sequence variable-length N-gram is used as the feature extraction method to further prove that the efficiency and accuracy of malicious code detection technology based on data mining and machine learning. </p> <p> </p>

An important aspect of building robust systems that execute on dedicated hardware and perhaps in constrained environments is to control and manage the effects performed by program code. We present ReML, a higher-order statically-typed functional language, which allows programmers to be explicit about the effects performed by program code and in particular effects related to memory management Allowing programmers to be explicit about effects, the regions in which values reside, and the constraints under which code execute, makes programs robust to changes in the program source code and to compiler updates, including compiler optimisations. ReML is integrated with a polymorphic inference system that builds on top of region-inference, as it is implemented in the MLKit, a Standard ML compiler that uses region-based memory management as its primary memory management scheme.

The malicious websites used by drive-by download attacks change their behavior for web client environments. To analyze the behavior of malicious websites, the singleenvironment analysis cannot obtain sufficient information. Hence, it is difficult to analyze the whole aspect of malicious websites. Also, the code obfuscation and cloaking are used in malicious websites to avoid to be analyzed their behavior. In this paper, we propose an analyzing method that combines decoding of the obfuscation code with dynamic analysis using multi-environment analysis system in order to analyze the behavior of the malicious websites in detail. Furthermore, we present two approaches to improve the multi-environment analysis. The first one is automation of traffic log analysis to reduce the cost of analyzing huge traffic logs between the environments and malicious websites. The second one is multimodal analysis for finding the URL of malicious websites.

This article is an addendum to the authors’ previous article (Kim, J. et al. (2008) Plant Cell 20, 307-319). The instrumentation and software described in this article were used to analyze the circadian leaf movement in the previous article. Here, we provide detailed and practical information on the instrumentation and the software. The source code of the LMA program is freely available from the authors. The circadian clock regulates a wide range of cyclic physiological responses with a 24 hour period in most organisms. Rhythmic leaf movement in plants is a typical robust manifestation of rhythms controlled by the circadian clock and has been used to monitor endogenous circadian clock activity. Here, we introduce a relatively easy, inexpensive, and simple approach for measuring leaf movement circadian rhythms using a USB-based web camera, public domain software and a Leaf Movement Assay (LMA) program. The LMA program is a semi-automated tool that enables the user to measure leaf lengths of individual Arabidopsis seedlings from a set of time-series images and generates a wave-form output for leaf rhythm. This is a useful and convenient tool for monitoring the status of a plant's circadian clock without an expensive commercial instrumentation and software.