Browsing by Author "Wang, Chiwei"

Now showing 1 - 2 of 2

DROIT: Dynamic Alternation of Dual-Level Tainting for Malware Analysis
(2015-01-01)
Wang, Chiwei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
Taint analysis for Android malware has received much attention in recent research. Existing taint techniques operate either at Java object level or at deeper instruction level. Object-level tracking is suitable for malware written in Java byte-code, but not for native ones. Instruction-level tracking captures the finest data flow. However, it leads to obscure semantic reconstruction and low performance. In this paper, we present DROIT, a taint tracker which dynamically alternates between object-level and instruction-level tracking on demands. DROIT tracks data flow at Java object level in general. When its Dalvik VM exits the byte-code execution, DROIT automatically switches to instruction-level tracking, and vice versa. The trigger-based DROIT can alternate between the two levels in an efficient manner, and can provide dual-level whole image of the data flow, rather than fragments. Tracking at the dual levels also eases the semantic reconstruction significantly. The experiment with Android information-stealing trojans showed that DROIT can handle Java-based malware, those composed in native code, and those alternating between the two levels (e.g., DroidKungFu), respectively.
SWIFT: Decoupled System-Wide Information Flow Tracking and its Optimizations
(2015-07-01)
Wang, Chiwei
;
Shieh, Shiuhpyng Winston
;
交大名義發表
;
National Chiao Tung University
Information flow analysis is a widely-adopted technique in software testing and malware analysis. For information flow analysis, a system-level emulator equipped with dynamic information flow tracking capability, DIFT, is needed. However, its effectiveness comes at a price of severe performance degradation due to interleaved system emulation and DIFT analysis. In this paper, a decoupled system-wide information flow tracking scheme, SWIFT, is proposed. Through decoupling system-wide information flow tracking from emulation, SWIFT regains the memory locality and code optimization. The proposed methods are able to aggressively eliminate dependency between the system-level emulator and the analysis thread. Our performance evaluation indicates that, under the same hardware specifications, SWIFT runs 2.74 similar to 7.48 times faster than the conventional interleaved design while being benchmarked by Pass Mark Performance Test 6.0. The performance improvement consequently makes the online analysis feasible in practice.