Malware Instrumentation Application to Regin Analysis

Botnets have become one of the main threats to cyberspace security. Although they can be detected by techniques such as reverse engineering, botnets using covert technologies such as fast-flux can successfully bypass existing security detection and continue to survive. The existing fast-flux botnet detection methods are mainly divided into active and passive, the former will cause a large network load, and the latter has the problem of cumbersome feature value extraction. In order to effectively detect fast-flux botnets and alleviate the problems in traditional detection methods, a fast-flux botnet detection method based on spatiotemporal features of network traffic is proposed, combined with convolutional neural networks and recurrent neural network models, the fast-flux botnet is detected from both spatial and temporal dimensions. Experiments performed on the CTU-13 and ISOT public data sets show that compared with other methods, the accuracy rate of the proposed method is 98.3%, the recall rate is 96.7%, and the accuracy is 97.5%.

Domain Generation Algorithms (DGA) is a basic building block used in almost all modern malware. Malware researchers have attempted to tackle the DGA problem with various tools and techniques, with varying degrees of success. We present a complex solution to populate DGA feed using reversed DGAs, third-party feeds, and a smart DGA extraction and clustering based on emulation of a large number of samples. Smart DGA extraction requires no reverse engineering and works regardless of the DGA type or initialization vector, while enabling a cluster-based analysis. Our method also automatically allows analysis of the whole malware family, specific campaign, etc. We present our system and demonstrate its abilities on more than 20 malware families. This includes showing connections between different campaigns, as well as comparing results. Most importantly, we discuss how to utilize the outcome of the analysis to create smarter protections against similar malware.

Microorganisms are employed on a large scale in a variety of industrial production processes, such as production of food and ingredients, beverages, pharmaceutical compo- nents and fine- and bulk chemicals. Improving the behaviour of these microorganisms is of crucial importance in the design of efficient production processes. In this thesis we focus use directed evolution, which is a method to improve the phe- notype of a microorganism without knowing what to change in the DNA to obtain the desired effect. Improved strains are obtained through the natural evolution processes of variation and selection by enforcing a strong selective pressure in the laboratory. The mutations that occur during such short evolution can be determined by sequencing the DNA of the improved strains and comparing it to the starting strain. Finally, relating the relevant mutations to the enforced phenotype is called reverse engineering. We describe the reverse engineering of mutations in ADY2 enabling lactate transport across the cell wall and mutations in ACE2, which in combination with aneuploidy, could be related to the origin of multi-cellular growth in yeast. Next-generation sequencing was employed to reconstruct genomes and infer mutations. This technology has made tremendous progress since its introduction in 2008 and has become affordable for individual laboratories. Sequencing poses many challenges to the field of bioinformatics, since genomes are long and repetitive (e.g. yeasts have millions of base pairs and humans billions), but current sequencing technology can only read up to 100 to 1000 base pairs in sequence. The computational methods developed in this thesis enable the use of sequencing technology in industrial microbiology research. A starting strain in this field is the yeast Saccharomyces cerevisiae CEN.PK113-7D. To determine its genome sequence we devel- oped an algorithm that uses a Tabu-search that exploits previously sequenced genomes and heterogeneous sequencing data types. Additionally, two methods were developed to infer mutations between genomes in absence of a high-quality closely related reference genome. First, we describe an algorithm that estimates the number of times a DNA subsequence exists in the full genome using a Poisson mixture model. We used this method to infer copy number differences between aneuploid lager brewing yeasts. Second, we describe an algorithm that uses graph decomposition to find variation in metagenomes, which are a combination of many bacterial genomes within one sample and play an important role in industrial fermentation, such as in production of cheese and yoghurt.

Cryptographic Primitives that Resist Backdooring and Subversion

The complexity of problems facing society continues to grow, and decision-makers and problem-solvers are finding many of today's emerging problems to be beyond their capability to adequately address. There is agreement in the literature that problems of this nature are complex system problems, inextricably linked to some highly complex system of systems. Establishing a clear understanding of the specific complex system context is fundamental to the process of understanding and analyzing complex systems and complex system problems across all of the different systems-based disciplines. While complex system context is widely referred to in systems literature, there is no clear characterization of exactly what system context is, making this foundational system concept ambiguous. This research addressed this gap in the systems body of knowledge by providing the needed detail and clarity to the concept of complex system context. A rigorous research methodology, employing the grounded theory method, was used to analyze data collected through a series of semi-structured interviews conducted with individuals reflecting a wide range of systems education and practical experience. Two research questions were identified as integral to increasing the understanding of context within complex systems. (1) What are the constituent elements of complex system context, and what attributes and dimensions characterize these elements? (2) What systems-based framework can be developed for constructing and articulating complex system context? Using the grounded theory method, a theory of system context was constructed, adding to the systems body of knowledge and substantiating a comprehensive and unambiguous theoretical construct for system context within complex systems. Then, based on this theory, a conceptual model to articulate and capture system-specific complex system context was developed---the Complex System Contextual Framework (CSCF). The CSCF shows significant promise for contribution to systems practitioners by supporting the future development of tools to help practitioners capture system context as a part of complex system problem formulation. The research also made a contribution in the area of research methodologies by furthering the use of the grounded theory method in the engineering management and systems engineering domain, an area where its application has been very limited.

Requirements engineering for complex software intensive systems has become a major challenge in many software development projects. Especially the automotive industry experiences the increasing complexity of software in vehicles, during the last years. An actual premium vehicle, for instance embodies up to hundred electronic control units (ECU) with easily a few hundred features, each. Beneath the definition of abstract features, an electronic control unit is described by different goals, scenarios, requirements, and constraints. To create a manageable and traceable requirements specification for complex systems that enables the change and reuse of requirements, many companies claim assistance for a seamless specification of requirements. To satisfy this claim necessary requirements-artefacts and abstraction levels have to be defined. Further the interrelations between different requirements-artefacts of one, and among different abstraction levels have to be analyzed and defined. Recent research in this area has shown the benefits of goals and scenarios in addition to traditional requirements. Moreover, several researchers and practitioners have already researched the interrelations between goals and scenarios. However these works do not focus on the interrelationships of goals, scenarios, and requirements on different abstraction levels. In a joint project with DaimlerChrysler and the Software Systems Engineering Group at the University of Duisburg-Essen, we introduced goals, scenarios, and requirements on different abstraction levels and applied it in the context of a development project at DaimlerChrysler.

Metric-based Evaluation of Implemented Software Architectures

Owners Prof. Dr. Hasan IBICIOGLU (Rector of Suleyman Demirel University) Prof. Dr. S. Nilay KESKIN (Dean of Engineering and Architecture Faculty at SDU) Chief Editorial Board Prof. Dr. Ata Utku AKCIL SDU Dept. of Mining Engineering, Isparta, TR Assoc. Prof. Dr. Tuncay YIGIT SDU Dept. of Computer Engineering, Isparta, TR Co-Editoral Board Ress. Assist. Ali GUNES SDU Dept. of Computer Engineering, Isparta, TR Ress. Assist. Erdal AYDEMIR SDU Dept. of Industrial Engineering, Isparta, TR Editorial Advisory Board Prof. Dr. Abdullah AVEY SDU Dept. of Civil Engineering, Isparta, TR Prof. Dr. Mustafa KUŞCU SDU Dept. of Geological Engineering Isparta, TR Prof. Dr. Osman IPEK SDU Dept. of Mechanical Engineering, Isparta, TR Prof. Dr. Rasit ALTINDAG SDU Dept. of Mining Engineering, Isparta, TR Prof. Dr. Zeynep B. SEYDIM SDU Dept. of Food Engineering Isparta, TR Prof. Dr. Ziya GENCEL SDU Dept. of City&Urban Planning, Isparta, TR Assoc. Prof. Dr. Gulin BEYHAN SDU Dept. of Architecture, Isparta, TR Assoc. Prof. Dr. M. Nuri DOLMAZ SDU Dept. of Geopyhsical Engineering, Isparta, TR Assoc. Prof. Dr. Selcuk COMLEKCI SDU Dept. of Elc. & Com. Engineering, Isparta, TR Assoc. Prof. Dr. Tuncay YIGIT SDU Dept. of Computer Engineering, Isparta, TR Assist. Prof. Dr. Gultekin OZDEMIR SDU Dept. of Industrial Engineering, Isparta, TR Assist. Prof. Dr. Sibel KAPLAN SDU Dept. of Textile Engineering, Isparta, TR Assist. Prof. Dr. Sibel YILDIZ SDU Dept. of Chemical Engineering, Isparta, TR Dr. M. Yunus PAMUKOGLU SDU Dept. of Enviromental Engineering, Isparta, TR

Advancements in malware development, including the use of file-less and memory-only payloads, have led to a significant interest in the use of volatile memory analysis by digital forensics practitioners. Memory analysis can uncover a wealth of information not available via traditional analysis, such as the discovery of injected code, hooked APIs, and more. Unfortunately, the process of analyzing such malicious code is largely left to analysts who must manually reverse engineer the code to discover its intent. This task is not only slow and error-prone, but is also generally left only to senior-level analysts to perform, given that significant reverse engineering skills are required. This work focuses on the use of code emulation to automatically complete one of the most common tasks of malware analysis -discovering a malware sample’s network activity. Our tool automatically discovers the locations where malware uses networking APIs, emulates the network operations, and records the parameters passed to those functions. Through the monitoring of such parameters, this work enables the automatic discovery of the IP addresses, domain names, and network ports utilized by malware to connect to remote command-and-control (C2) servers as well as accept incoming connections. This novel use of emulation applied to in-memory code provides significant benefits compared to traditional whole-system emulation, which requires a full executable to run and does not match the environment that malware executed during a live incident. In contrast, our approach can emulate any code in memory, including inside of shellcode buffers and memory-only libraries. The novel network API monitoring capabilities developed for this research project were written as an extension to HookTracer, which is an plugin for the Volatility memory analysis framework. HookTracer provides emulation of API hooks in memory, but does not target any specific network activity. The contribution of this work is the incorporation of network API monitoring into HookTracer, development of a test suite that ensures the parameter monitoring is correct, and the evaluation of the techniques we have developed against real-world malware.

PayPal, FBI and others wage war on Botnet armies. Can they succeed?

Security software, commonly known as Antivirus, has evolved from simple virus scanners to become multi-functional security suites. To combat ever-growing malware threats, modern security software utilizes both static and dynamic analysis to assess malware threats, inevitably leading to occasional false positive and false negative reports. To mitigate this, existing state-of-the-art security software offers the feature of Exclusion Lists to allow users to exclude specified files and folders from being scanned or monitored. Through rigorous evaluation, however, we found that some of such products stored their Exclusion Lists as unencrypted cleartexts either in known or predictable locations. In this paper we empirically demonstrate how easy it is to exploit the Exclusion Lists by launching masquerade attacks. We argue that the Exclusion Lists should be better implemented such as using application whitelisting, the contents of the lists to be better safeguarded, and only be readable by authorized entities within a strong access control scheme.

A Reverse Engineering- (RE) and Rapid Prototyping- (RP) based approach to the development of a joystick handgrip with ergonomic features has been elaborated. The integration of Time Compression Techniques and Computer Aided Tools lead to a time-saving procedure for the design of a product whose ergonomic quality directly descends from users' sensations of comfort. The CAD model availability throughout the progressive steps of product development ensured all the potentialities of Concurrent Engineering, while Computer Aided Engineering (CAE) simulation on the definitive geometry allowed to close the Computer Integrated loop to the manufacturing process.

Modern computer architectures have evolved from uni-processor platforms to multi-processor and multi-core platforms, but traditional real-time distributed middleware such as RT-CORBA has not kept pace with that evolution. To address those issues, this paper describes the design and implementation of MCFlow, a new real-time distributed middleware for dependent task graphs running on multi-core platforms. MCFlow provides the following contributions to the state of the art in real-time middleware: (1) it provides an efficient C++ based component model through which computations can be configured flexibly for execution within a single core, across cores of a common host, or spanning multiple hosts; (2) it allows optimizations for inter-component communication to avoid data copying without sacrificing the parallel executability of data dependent tasks; (3) it strictly separates timing and functional concerns of an application so that they can evolve and can be configured independently; and (4) it provides a novel event dispatching architecture that uses lock free algorithms to avoid mutex locking and reduce memory contention, CPU context switching, and priority inversion. We also present an empirical evaluation that demonstrates the efficacy of our approach. Type of Report: Other Department of Computer Science & Engineering Washington University in St. Louis Campus Box 1045 St. Louis, MO 63130 ph: (314) 935-6160 The Design and Implementation of MCFlow: a Real-time Multi-core Aware Middleware for Dependent Task Graphs Huang-Ming Huang, Christopher Gill, Chengyang Lu Department of Computer Science and Engineering, Washington University St. Louis, MO, USA {hh1, cdgill, lu}@cse.wustl.edu Abstract—Modern computer architectures have evolved from uni-processor platforms to multi-processor and multi-core platforms, but traditional real-time distributed middleware such as RT-CORBA has not kept pace with that evolution. To address those issues, this paper describes the design and implementation of MCFlow, a new real-time distributed middleware for dependent task graphs running on multi-core platforms. MCFlow provides the following contributions to the state of the art in real-time middleware: (1) it provides an efficient C++ based component model through which computations can be configured flexibly for execution within a single core, across cores of a common host, or spanning multiple hosts; (2) it allows optimizations for inter-component communication to avoid data copying without sacrificing the parallel executability of data dependent tasks; (3) it strictly separates timing and functional concerns of an application so that they can evolve and can be configured independently; and (4) it provides a novel event dispatching architecture that uses lock free algorithms to avoid mutex locking and reduce memory contention, CPU context switching, and priority inversion. We also present an empirical evaluation that demonstrates the efficacy of our approach.Modern computer architectures have evolved from uni-processor platforms to multi-processor and multi-core platforms, but traditional real-time distributed middleware such as RT-CORBA has not kept pace with that evolution. To address those issues, this paper describes the design and implementation of MCFlow, a new real-time distributed middleware for dependent task graphs running on multi-core platforms. MCFlow provides the following contributions to the state of the art in real-time middleware: (1) it provides an efficient C++ based component model through which computations can be configured flexibly for execution within a single core, across cores of a common host, or spanning multiple hosts; (2) it allows optimizations for inter-component communication to avoid data copying without sacrificing the parallel executability of data dependent tasks; (3) it strictly separates timing and functional concerns of an application so that they can evolve and can be configured independently; and (4) it provides a novel event dispatching architecture that uses lock free algorithms to avoid mutex locking and reduce memory contention, CPU context switching, and priority inversion. We also present an empirical evaluation that demonstrates the efficacy of our approach. Keywords-component; middleware

The Android platform, with a large market share from its inclusive openness, faces a big problem with repackaging attacks, because reverse engineering is made easy due to the signature method that allows self-sign and also due to application structure. A repackaging attack is a method of attack, where an attacker with malicious intent alters an application distributed on the market to then redistribute it. The attacker injects into the original application illegal advertisement or malicious code that extracts personal information, and then redistributes the app. To protect against such repackaging attacks, obfuscation methods and tampering detection schemes to prevent application analysis are being developed and applied to Android applications. However, through dynamic analysis, protection methods at the managed code can be rendered ineffective, and there is a need for a protection method that will address this. In this paper, we show that, using Dalvik monitor, protection methods at the managed code level can be dynamically analyzed. In addition, to prevent a tampered application from running, we propose a tampering detection scheme that uses a dynamic attestation platform. It consist of two phases; (1) detection code injection: inject tamper detecting code into an application and (2) code attestation: attest the injected code on the platform. The proposed scheme first uses the tamper detection method at the platform level to inspect execution codes executed in real time and to fundamentally intercept repackaged applications.

In Man-At-The-End (MATE) attacks, software apps run on a device under full control of the attackers: they can violate the intellectual property of the app by means of malicious reverse engineering, software piracy, and software tampering. Obfuscation is a technique that is widely adopted by developers to mitigate this problem. Obfuscation increases complexity of software code, by obscuring the structure of code and data in order to thwart the reverse engineering process. However, it is possible to reverse engineer obfuscated code with time, determination and the right tools. In general, there is no accepted methodology to determine the strength of obfuscated code; however resilience is often considered a good metric as it indicates the percentage of obfuscated code that cannot be removed by automated de-obfuscation tools. We introduce a novel approach to measure the resilience of obfuscated C code using program slicing. Given a variable of interest, that might be part of a code region used to manipulate a crypto key or a license number, program slicing can mimic the attacker behaviour by trying to remove the code unrelated to that variable, acting as a new type of de-obfuscator.