Eric.freyssinet: Text replacement - " www.cs.ucsb.edu" to ""

2015-08-05T20:16:44Z

Text replacement - " www.cs.ucsb.edu" to ""

← Older revision		Revision as of 20:16, 5 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Type=Conference paper		\|Type=Conference paper
	\|Link=http://www.cs.ucsb.edu/~chris/research/doc/acsac11_barebox.pdf ~~www.cs.ucsb.edu~~		\|Link=http://www.cs.ucsb.edu/~chris/research/doc/acsac11_barebox.pdf
	\|Author=Dhilung Kirat, Giovanni Vigna, Christopher Kruegel		\|Author=Dhilung Kirat, Giovanni Vigna, Christopher Kruegel
	\|NomRevue=Annual Computer Security Applications Conference Technical Track Papers		\|NomRevue=Annual Computer Security Applications Conference Technical Track Papers

Eric.freyssinet: 1 revision imported

2015-02-07T14:26:50Z

1 revision imported

← Older revision		Revision as of 14:26, 7 February 2015
(No difference)

Eric.freyssinet at 21:23, 14 August 2013

2013-08-14T21:23:28Z

New page

{{Publication
|Type=Conference paper
|Link=http://www.cs.ucsb.edu/~chris/research/doc/acsac11_barebox.pdf www.cs.ucsb.edu
|Author=Dhilung Kirat, Giovanni Vigna, Christopher Kruegel
|NomRevue=Annual Computer Security Applications Conference Technical Track Papers
|Date=2011
|Editor=Annual Computer Security Applications Conference
|Year=2011
|Abstract=Present-day malware analysis techniques use both virtualized and emulated environments to analyze malware. The reason is that such environments provide isolation and system restoring capabilities, which facilitate automated analysis of malware samples. However, there exists a class of malware, called VM-aware malware, which is capable of detecting such environments and then hide its malicious behavior to foil the analysis. Because of the artifacts introduced by virtualization or emulation layers, it has always been and
will always be possible for malware to detect virtual environments.
The definitive way to observe the actual behavior of VM-aware malware is to execute them in a system running on real hardware, which is called a "bare-metal" system. However, after each analysis, the system must be restored back to the previous clean state. This is because running a malware program can leave the system in an instable/insecure
state and/or interfere with the results of a subsequent analysis run. Most of the available state-of-the-art system restore solutions are based on disk restoring and require a system
reboot. This results in a significant downtime between each analysis. Because of this limitation, efficient automation of malware analysis in bare-metal systems has been a challenge.
This paper presents the design, implementation, and evaluation of a malware analysis framework for bare-metal systems that is based on a fast and rebootless system restore
technique. Live system restore is accomplished by restoring the entire physical memory of the analysis operating system from another, small operating system that runs outside
of the target OS. By using this technique, we were able to perform a rebootless restore of a live Windows system, running on commodity hardware, within four seconds. We also
analyzed 42 malware samples from seven different malware families, that are known to be "silent" in a virtualized or emulated environments, and all of them showed their true
malicious behavior within our bare-metal analysis environment.
|Keyword=bare metal, dynamic malware analysis, system restore, VM-aware
}}

BareBox: efﬁcient malware analysis on bare-metal - Revision history

Eric.freyssinet: Text replacement - " www.cs.ucsb.edu" to ""

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 21:23, 14 August 2013