Exploiting an Antivirus Interface

Sujets

• Arts

Informations

• Publié par: onytodor
• Nombre de lectures: 59
• Langue: English

Extrait

Exploiting an Antivirus Interface

a,∗a a Kevin W. Hamlen , Vishwath Mohan , Mohammad M. Masud , a a Latifur Khan , Bhavani Thuraisingham

a Computer Science Department, University of Texas at Dallas, 800 W. Campbell Rd., Richardson, Texas 75080, USA

Abstract We propose a technique for defeating signaturebased malware detectors by ex ploiting information disclosed by antivirus interfaces. This information is lever aged to reverse engineer relevant details of the detector’s underlying signature database, revealing binary obfuscations that suffice to conceal malware from the detector. Experiments with real malware and antivirus interfaces on Windows operating systems justifies the effectiveness of our approach. Key words:Security, Signaturebased malware detection, Data mining, Binary obfuscation

1. Introduction

Traditionalsignaturebasedmalware detectors identify malware by scanning untrusted binaries for distinguishing byte sequences orfeaturesunique. Features to malware are maintained in asignature database, which must be continually updated as new malware is discovered and analyzed. Signaturebased malware detection generally enforces a static approximation of some desired dynamic (i.e., behavioral) security policy. For example, access control policies, such as those that prohibit code injections into operating system executables, are statically undecidable and can therefore only be approximated by any purely static decision procedure such as signaturematching. A signature based malwaredetector approximates these policies by identifying syntactic fea tures that tend to appear only in binaries that exhibit policyviolating behavior when executed. This approximation is both unsound and incomplete in that it is susceptible to both false positive and false negative classifications of some binaries. For this reason signature databases are typically kept confidential, since they contain information that an attacker could use to craft malware that

∗ Corresponding author Email addresses:[e-mail](Kevin W. Hamlen), [e-mail](Vishwath Mohan),[e-mail] (Mohammad M. Masud),[e-mail](Latifur Khan), [e-mail](Bhavani Thuraisingham)

Preprint submitted to Elsevier

April 21, 2009