کد مقاله کد نشریه سال انتشار مقاله انگلیسی نسخه تمام متن
6884072 1444212 2018 29 صفحه PDF دانلود رایگان
عنوان انگلیسی مقاله ISI
Efficient dynamic malware analysis using virtual time control mechanics
ترجمه فارسی عنوان
تجزیه و تحلیل مخرب دینامیک کارآمد با استفاده از مکانیک کنترل زمان مجازی
موضوعات مرتبط
مهندسی و علوم پایه مهندسی کامپیوتر شبکه های کامپیوتری و ارتباطات
چکیده انگلیسی
Efficient detection of stealthy malware attacks in suspicious files is very challenging as dynamic malware analysis is time consuming. This paper proposes a virtual time control mechanics-based method to overcome the challenge. The proposed method utilizes a modified Xen hypervisor, in which a virtual clock source is generated according to a predefined speed ratio, such that sandbox systems running on the modified hypervisor can be accelerated. Thus, it does not modify operating system kernels nor intercept system function calls, and is therefore compatible with various operating systems. Further, it utilizes an entropy-based measure that adjusts its execution time according to various malware inputs as an early termination criterion. The results of experiments conducted to verify the efficacy of the proposed method indicate that it speeds up the system timer and significantly increases the logged record size by up to 42% or obtains the same log size within a shorter period compared with conventional sandboxes. Thus, the proposed virtual time control mechanics-based method efficiently detects nontrivial anomalous codes that may be neglected by conventional sandboxing techniques.
ناشر
Database: Elsevier - ScienceDirect (ساینس دایرکت)
Journal: Computers & Security - Volume 73, March 2018, Pages 359-373
نویسندگان
, , ,