Antivirus Software Shield Against Antivirus Terminators

Hsu, Fu-Hau; Wu, Min-Hao; Tso, Chang-Kuo; Hsu, Chi-Hsien; Chen, Chieh-Wen

doi:10.1109/tifs.2012.2206028

Cited by 21 publications

(13 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Protection of anti-virus software from termination, which called ANSS, was proposed [3]. ANSS hooks system calls related to process termination and controls them if they would stop anti-virus software.…”

Section: Existing Countermeasuresmentioning

confidence: 99%

“…ANSS [3] is effective for protecting anti-virus software from termination. ANSS intercepts and monitors some API calls with parameters that will stop or suspend anti-virus software to filter out malicious calls.…”

Section: Related Workmentioning

confidence: 99%

“…However, these methods do not utilize existing essential services and software already installed and operational. Hsu et al proposed a method to prevent anti-virus software from being terminated without the consciousness of the anti-virus software users [3]. This method monitors Windows application program interfaces (APIs) by system service descrip- 1 Graduate School of Natural Science and Technology, Okayama University, Okayama 700-8530, Japan a) sato@cs.okayama-u.ac.jp tor table (SSDT) hooking and filter out hazardous API calls that will terminate anti-virus software.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Process Hiding by Virtual Machine Monitor for Attack Avoidance

Sato

Yamauchi

Takahashi

2015

Journal of Information Processing

View full text Add to dashboard Cite

As attacks to computers increase, protective software is developed. However, that software is still open to attacks by adversaries that disable its functionality. If that software is stopped or disabled, the risk of damage to the computer increases. Protections of that software are proposed however existing approaches are insufficient or cannot use those software without modification. To decrease the risk and to address these problems, this paper presents an attack avoidance method that hides process from adversaries who intend to terminate essential services. The proposed method complicates identification based on process information by dynamically replacing the information held by a kernel with dummy information. Replacing process information makes identifying the attack target difficult because adversaries cannot find the attack target by seeking the process information. Implementation of the proposed method with a virtual machine monitor enhances the security of the mechanism itself. Further, by implementing the proposed method with a virtual machine monitor, modification to operating systems is unnecessary.

show abstract

Section: Existing Countermeasuresmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Process Hiding by Virtual Machine Monitor for Attack Avoidance

Sato

Yamauchi

Takahashi

2015

Journal of Information Processing

View full text Add to dashboard Cite

show abstract

“…Although we have many effective methods for tackling known attacks, such as firewalls [6], antivirus [7] and intrusion detection [8], how to deal with unknown attacks is still a challenge [9]. Inescapable vulnerabilities and backdoors deriving from design or implementation flaws further increase the passivity of the defender [10].…”

Section: Introductionmentioning

confidence: 99%

A Novel Model of Mimic Defense Based on Minimal L-Order Error Probability

et al. 2020

View full text Add to dashboard Cite

Mimic defense is an active defense theory, which aims to fundamentally change the "easy to attack and difficult to defend" situation of network security. In this paper, we propose an evaluation method based on the minimum probability of successful attack, and improve the evaluation scheme of historical confidence. We combine the two evaluation schemes with the TOPSIS (technique for order performance by similarity to ideal solution) algorithm, and finally form a complete heterogeneous variant dynamic scheduling model. Different from traditional multi-mode voting algorithm, the effect of heterogeneous degree in voting is considered, and we use Bayesian estimation to obtain the optimal result in the probabilistic sense. Finally, simulation results show that the proposed algorithm can effectively enhance the dynamic and security of the mimic defense model, and give full play to the characteristics of mimic defense.

show abstract

“…The second problem is the security problems of antivirus applications themselves. Research [4] shows that there are several approaches to disable antivirus software. Moreover, as described by CloudAV [5,6], antivirus cannot guarantee the security of the computers that install it.…”

Section: Introductionmentioning

confidence: 99%

A Cloud-Based Real-Time Mechanism to Protect End Hosts against Malware

et al. 2019

Self Cite

View full text Add to dashboard Cite

Nowadays, antivirus is one of the most popular tools used to protect computer systems. Diverse antivirus vendors are established to protect their customers against malware. However, antivirus is facing some critical problems, such as significant detection windows, vulnerability inside antivirus, and long scanning time. In this paper, we recommend a cloud-based real-time defense mechanism named Skywalker to allow users to safely utilize antivirus without the above problems. After Skywalker is installed in a host, the host does not need to install any antivirus. However, Skywalker guarantees that the host only executes programs that have been verified by a cloud-based scanner, such as VirusTotal. VirusTotal uses 56 antivirus engines to check whether a program is malware. Research shows that the more antivirus engines are used, the more accurate the result is. Because the above scan is performed right before the execution of every program, Skywalker provides 24/7 real-time protection to a system. Besides, Skywalker eliminates the need to spend a lot of time scanning all files in a host. Experimental results show that after a program has been executed once, it takes Skywalker, at most, 0.47091 s to start the program again. Meanwhile, VirusTotal provides a secure protection to client hosts.

show abstract

Antivirus Software Shield Against Antivirus Terminators

Cited by 21 publications

References 5 publications

Process Hiding by Virtual Machine Monitor for Attack Avoidance

Process Hiding by Virtual Machine Monitor for Attack Avoidance

A Novel Model of Mimic Defense Based on Minimal L-Order Error Probability

A Cloud-Based Real-Time Mechanism to Protect End Hosts against Malware

Contact Info

Product

Resources

About