https://scholars.lib.ntu.edu.tw/handle/123456789/500901
標題: | Memory forensics using virtual machine introspection for Malware analysis | 作者: | Tien, C.-W. Liao, J.-W. Chang, S.-C. Kuo, S.-Y. SY-YEN KUO |
關鍵字: | Advanced malware analysis; Cyber security; Security sandbox; Virtual machine introspection | 公開日期: | 2017 | 起(迄)頁: | 518-519 | 來源出版物: | 2017 IEEE Conference on Dependable and Secure Computing | 摘要: | A security sandbox is a technology that is often used to detect advanced malware. However, current sandboxes are highly dependent on VM hypervisor types and versions. Thus, in this paper, we introduce a new sandbox design, using memory forensics techniques, to provide an agentless sandbox solution that is independent of the VM hypervisor. In particular, we leverage the VM introspection method to monitor malware running memory data outside the VM and analyze its system behaviors, such as process, file, registry, and network activities. We evaluate the feasibility of this method using 20 advanced and 8 script-based malware samples. We furthermore demonstrate how to analyze malware behavior from memory and verify the results with three different sandbox types. The results show that we can analyze suspicious malware activities, which is also helpful for cyber security defense. © 2017 IEEE. |
URI: | https://scholars.lib.ntu.edu.tw/handle/123456789/500901 | DOI: | 10.1109/DESEC.2017.8073871 | SDG/關鍵字: | Computer crime; Network security; Virtual machine; Cyber security; ITS systems; Malware analysis; Malware behaviors; Memory forensics; Network activities; Security sandbox; Virtual machine introspection; Malware |
顯示於: | 電機工程學系 |
在 IR 系統中的文件,除了特別指名其著作權條款之外,均受到著作權保護,並且保留所有的權利。