The other guys: automated analysis of marginalized malware

Antivirus companies, mobile application marketplaces, and the security research community, employ techniques based on dynamic code analysis to detect and analyze mobile malware. In this paper, we present a broad range of anti-analysis techniques that malware can employ to evade dynamic analysis in emulated Android environments. Our detection heuristics span three different categories based on (i) static properties, (ii) dynamic sensor information, and (iii) VM-related intricacies of the Android Emulator. To assess the effectiveness of our techniques, we incorporated them in real malware samples and submitted them to publicly available Android dynamic analysis systems, with alarming results. We found all tools and services to be vulnerable to most of our evasion techniques. Even trivial techniques, such as checking the value of the IMEI, are enough to evade some of the existing dynamic analysis frameworks. We propose possible countermeasures to improve the resistance of current dynamic analysis tools against evasion attempts.

Malware is one of the biggest security threats on the Internet today and deploying effective defensive solutions requires the rapid analysis of a continuously increasing number of malware samples. With the proliferation of metamorphic malware the analysis is further complicated as the efficacy of signature-based static analysis systems is greatly reduced. While dynamic malware analysis is an effective alternative, the approach faces significant challenges as the ever increasing number of samples requiring analysis places a burden on hardware resources. At the same time modern malware can both detect the monitoring environment and hide in unmonitored corners of the system.In this paper we present DRAKVUF, a novel dynamic malware analysis system designed to address these challenges by building on the latest hardware virtualization extensions and the Xen hypervisor. We present a technique for improving stealth by initiating the execution of malware samples without leaving any trace in the analysis machine. We also present novel techniques to eliminate blind-spots created by kernel-mode rootkits by extending the scope of monitoring to include kernel internal functions, and to monitor file-system accesses through the kernel's heap allocations. With extensive tests performed on recent malware samples we show that DRAKVUF achieves significant improvements in conserving hardware resources while providing a stealthy, in-depth view into the behavior of modern malware.

The Dynamic Analysis and Design System software is a set of general purpose computer programs that can be used to model and predict the motion of a variety of real world mechanical systems. Using a set of data that describes the machine to be modeled, DADS builds a mathematical model of the real system that calculates positions, velocities, and accelerations of the various parts of the machine, as well as resultant forces that act in the system. By using such a computer program to analyze a machine, the designer can simulate the behavior of a wide range of alternate designs prior to building and testing prototypes. The DADS program is often used for analysis of existing mechanical systems also.

: A dynamic model of the Polaris Sportsman 500 All-Terrain Vehicle (ATV) was built using Dynamic Analysis and Design System (DADS) version 8.5. Aspects of the model included the front MacPherson struts and rear independent suspension. The model also allowed control over the path and speed of the vehicle using the DADS control elements. The modeling methods discussed here are general in nature and may be applied to other DADS vehicle models of similar systems. This report also provides a usefull reference source to those using this model.

This study is intended to assist property-casualty insurers in modeling their dynamic financial analysis (DFA) system. Moreover, we address the important steps and considerations that go into a user-friendly adaptive decision support system with which the modeler is capable of easily refining the associated models of risk factors through a series of GUIs with as much work as possible left to the computer system.

In order to design the perception system of the lower limb wearable rehabilitation robot, this study established the kinematics theoretical model of human lower limb and conducted the kinematics analysis of human body. By using the dynamic attitude analysis system, combined with the human body mark points, the position data of human body mark points in the process of standing up, sitting up, walking, stepping up, and squatting were collected. Combined with the movement mechanism of human lower limbs, the characteristics of human motion state transition are analyzed, and the perceptual algorithm for judging human motion intention is studied, so as to determine the wearer's current posture, standing intention while sitting, walking intention while standing, moving intention, and stopping intention during walking. The results show that the angle of the hip joint changes regularly between 0° and 37° and the angle of the knee joint changes regularly between 0° and 70°during the standing process, which is consistent with the angle change trajectory collected by the dynamic attitude analysis system. The angle trajectories of the hip and knee joints measured by the absolute angle sensor are the same as those obtained by the dynamic attitude analysis system. 1.5 rad and 0.3 rad were selected as reasonable and effective thresholds for determining sitting and standing states.

The paper presents the development of a measurement system for dynamic stability analysis. The system is composed of an actuation device, that is a robotic platform with four degrees of freedom, and two measurement systems: a force platform, to measure the position of the centre of pressure (COP), and a vision system, to measure the position of the centre of mass (COM). The purpose of the system is to provide means to identify whether a subject behaves like an inverted pendulum (as the literature predicts for static posturography), when a dynamic perturbation is applied. This can be achieved by generating a movement of the robotic platform and, simultaneously, by measuring COP and COM trajectories and verify their coherence with the inverse pendulum model.

Malware Analysis and Classification Systems use static and dynamic techniques, in conjunction with machine learning algorithms, to automate the task of identification and classification of malicious codes. Both techniques have weaknesses that allow the use of analysis evasion techniques, hampering the identification of malwares. In this work, we propose the unification of static and dynamic analysis, as a method of collecting data from malware that decreases the chance of success for such evasion techniques. From the data collected in the analysis phase, we use the C5.0 and Random Forest machine learning algorithms, implemented inside the FAMA framework, to perform the identification and classification of malwares into two classes and multiple categories. In our experiments, we showed that the accuracy of the unified analysis achieved an accuracy of 95.75% for the binary classification problem and an accuracy value of 93.02% for the multiple categorization problem. In all experiments, the unified analysis produced better results than those obtained by static and dynamic analyzes isolated.

The superiority of the dynamic ripening and analysis (DRA) system based on a filter for all directions of use compared to the currently valid ripening system with the usage-specific ripening figures separated into silage and grain maize in Germany is demonstrated in a system-biological way. The silage maize ripeness index (SRI) as the sole indicator for the fixation of the harvest time, the evidence of biotic and abiotic plant stress as well as the selection of environmentally and ripeness-stable maize varieties for all directions of use is multifunctional direction and filter. The grower can make crop decisions in the near-harvest period for planning the processes and carrying out the harvest to be optimized. The reference ripeness point (SRI of 2.8) enables the full exploitation of the phenotypic performance and resistance potential in maize cultivation by standardizing the ecophysiological optimal maize ripeness of genotype and phenotype and, in the long term, through the risk assessment of climatic changes. The social acceptance of maize cultivation can be significantly increased through the better economic and ecological aspects of the DRA system.

This paper provides a comprehensive analysis of the impact of wind farm integration on the stability of an electrical power system, with a particular focus on the dynamic effects induced by wind power during severe system disturbances. The primary objective is to evaluate how wind power integration influences system behavior, particularly under fault conditions. The research utilized the IEEE 9-bus test system, which consists of three generators and nine buses, as a reference benchmark for the stability analysis. Simulations and modeling were performed using PSAT (Power System Analysis Toolbox), a robust tool for static, dynamic, and control analysis of power systems, integrated with Matlab. The study specifically investigated the effects of a three-phase short circuit, representing a significant system disturbance. The dynamic analysis was structured into three phases: pre-fault, fault, and post-fault, to capture the complete impact on system behavior. The results provided valuable insights into critical electrical and electromechanical variables, shedding light on the role of wind farms in maintaining the stability of the power grid, with particular emphasis on the transmission network's resilience and response to disturbances. This work offers a deeper understanding of the integration of renewable energy sources in enhancing grid stability during extreme events.

The paper considers the problem of simultaneous modeling of structure and flow in a piping system. It takes a middle road between full coupled analysis on the one hand, and the simplified case of treating the liquid as a rigid mass. The suggested method allows the use of standard beam and rod elements for the analysis. Two approaches to the problem of dynamic interaction between pipe and medium are compared in the given paper: 1) The first one treats medium as mass rigidly connected to the pipe finite-element model’s nodes. 2) In the second one medium is modeled by the finite-element system of rod-elements. In this case the basic fluid-structure interaction (FSI) effects are taken into account. The main techniques for FE modeling of some pipeline elements are presented in the paper. The second approach can be implemented by the use of general purpose FE programs. A model of a feed water pipeline of VVER-440 type NPP has been developed to study how the FSI affects on pipeline response. The results of the analysis which allow estimation of inaccuracy arising from medium dynamics neglecting are as follows: • calculation of eigen frequency and mode shapes; • seismic analysis using the response-spectrum method; • accidental blast impact assessment with the use of time history analysis; • operating vibration assessment on the basis of harmonic analysis. It has become apparent that the way of medium modeling has an essential influence on the dynamic behavior of pipelines.

We introduce PyTrigger, a dynamic malware analysis system that automatically exercises a malware binary extracting its behavioral profile even when specific user activity or input is required. To accomplish this, we developed a novel user activity record and playback framework and a new behavior extraction approach. Unlike existing research, the activity recording and playback includes the context of every object in addition to traditional keyboard and mouse actions. The addition of the context makes the playback more accurate and avoids dependencies and pitfalls that come with pure mouse and keyboard replay. Moreover, playback can become more efficient by condensing common activities into a single action. After playback, PyTrigger analyzes the system trace using a combination of multiple states and behavior differencing to accurately extract the malware behavior and user triggered behavior from the complete system trace log. We present the algorithms, architecture and evaluate the PyTrigger prototype using 3994 real malware samples. Results and analysis are presented showing PyTrigger extracts additional behavior in 21% of the samples.

This paper presents an argument for distributing dynamic software analyses to large populations of users in order to locate bugs that cause security flaws. We review a collection of dynamic analysis systems and show that, despite a great deal of effort from the research community, their performance is still too low to allow their use in the field. We then show that there are effective sampling mechanisms for accelerating a wide range of powerful dynamic analyses. These mechanisms reduce the rate at which errors are observed by individual analyses, but this loss can be offset by the subsequent increase in test population. Nevertheless, there are unsolved issues in this domain that deserve attention if this technique is to be widely utilized.

In this paper we describe how the knowledge related to a specific domain and the available visual analysis tools can be used to create dynamic visual analysis systems for video surveillance.Firstly, the knowledge is described in terms of application domain (types of objects, events... that can appear in such domain) and system capabilities (algorithms, detection procedures...) by using an existing ontology.Secondly, the ontology is integrated into a framework to create the visual analysis systems for each domain by inspecting the relations between the entities defined in the domain and system knowledge.Additionally, when necessary, analysis tools could be added or removed on-line.Experiments/Application of the framework show that the proposed approach for creating dynamic visual analysis systems is suitable for analyzing different video surveillance domains without decreasing the overall performance in terms of computational time or detection accuracy.

Code instrumentation and hardware based event trapping are two primary approaches used in dynamic malware analysis systems. In this paper, we propose a new approach called Execution Flow Instrumentation (EFI) where the analyzer execution flow is interleaved with the target flow in user- and kernel-mode, at junctures flexibly chosen by the analyzer at runtime. We also propose OASIS as the system infrastructure to realize EFI with virtues of the current two approaches, however without their drawbacks. Despite being securely and transparently isolated from the target, the analyzer introspects and controls it in the same native way as instrumentation code. We have implemented a prototype of OASIS and rigorously evaluated it with various experiments including performance and anti-analysis benchmark tests. We have also conducted two EFI case studies. The first is a cross-space control flow tracer and the second includes two EFI tools working in tandem with Google Syzkaller. One tool makes a dynamic postmortem analysis according to a kernel crash report; and the other explores the behavior of a malicious kernel space device driver which evades Syzkaller logging. The studies show that EFI analyzers are well-suited for fine-grained on-demand dynamic analysis upon a malicious thread in user or kernel mode. It is easy to develop agile EFI tools as they are user-space programs.