Empirical study to fingerprint public malware analysis services

Botas, Á. ; Rodríguez, R.J. ; Matellán, V. ; García, J.F.

Resumen: The evolution of malicious software (malware) analysis tools provided controlled, isolated, and virtual environments to analyze malware samples. Several services are found on the Internet that provide to users automatic system to analyze malware samples, as VirusTotal, Jotti, or ClamAV, to name a few. Unfortunately, malware is currently incorporating techniques to recognize execution onto a virtual or sandbox environment. When analysis environment is detected, malware behave as a benign application or even show no activity. In this work, we present an empirical study and characterization of automatic public malware analysis services. In particular, we consider 26 different services. We also show a set of features that allow to easily fingerprint these services as analysis environments. Finally, we propose a method to mitigate fingerprinting.

Idioma: Inglés

DOI: 10.1007/978-3-319-67180-2_57

Año: 2018

Publicado en: Advances in intelligent systems and computing 649 (2018), 589-599
ISSN: 2194-5357

Factor impacto SCIMAGO: 0.174 - Control and Systems Engineering (Q3) - Computer Science (miscellaneous) (Q3)

Financiación: info:eu-repo/grantAgreement/ES/MINECO/TIN2014-58457-R
Financiación: info:eu-repo/grantAgreement/ES/UZ/CUD2016-TEC-06

Tipo y forma: Artículo (PostPrint)