Behavioral analysis of malicious code through network traffic and system call monitoring

Abstract

Malicious code (malware) that spreads through the Internet-such as viruses, worms and trojans-is a major threat to information security nowadays and a profitable business for criminals. There are several approaches to analyze malware by monitoring its actions while it is running in a controlled environment, which helps to identify malicious behaviors. In this article we propose a tool to analyze malware behavior in a non-intrusive and effective way, extending the analysis possibilities to cover malware samples that bypass current approaches and also fixes some issues with these approaches.

Advanced threat intelligence: detection and classification of anomalous behavior in system processes

“…The instrument used for collecting the data is a monitoring agent prototype dubbed "Sonar". It runs as part of the Windows kernel and utilizes SSDT hooking [14,15] to remain undetected. Sonar collects process, thread, image load, file, registry, and network events in the form of abstracted API and system calls.…”

The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures

“…One of the first projects using this technique was the NTRegmon by Russinovich and Cogswell [12], which monitors all registry activity on a system. It also shows that SSDT-Hooking can be used with a non-malicious intent, for example many antivirus and malware detection systems [19] depend on this technique too. Detection -This technique is similar to its counterpart in the user-mode, consequently it can also be detected in a similar way.…”

Semantics-aware detection of targeted attacks: a survey

“…Fukushima's system utilizes Procmon [126] as primary data provider. Unlike BehEMOT's postmonitoring abstraction [60], Procmon abstracts system calls in a non-transparent manner prior to analysis. For this reason, many additional calls are not considered.…”

“…The VM-based dynamic analysis system is built around the TRUMAN sandnet [40] that logs contacted IP addresses, created, changed, and deleted files, as well as registry activity. While some features are taken from CWSandbox [142], others are comparable to the generally more detailed BehEMOT approach [60]. The file output is akin to a list of changes to the original system state.…”

“…Dynamic malware detection and analysis is covered by a multitude of articles: Grégio et al [60] introduce BehE-MOT, a non-intrusive malware behavior analysis system. It uses both a native and emulated system environment that promises to circumvent sandbox detection.…”