<link rel="stylesheet" href="styles.cf390c6bfbe7555f.css">

學術出版;;Publications

Permanent URI for this communityhdl:11536/1

收集所有交通大學研究人員與學生個人或團體所發表之各項學術著作，涵蓋期刊論文、教師專書、學位論文等項。;;Collections of Publications of NCTU Researchers and Students Like Journal Papers and Thesis.

Browse

Filters

20172

Settings

🏛️國立陽明交通大學機構典藏

Author: search.filters.author.Shieh, Shiuhpyng WinstonSubject: search.filters.subject.malware

Search Results

Now showing 1 - 2 of 2
  • Thumbnail Image
    Item type:Item,
    Shellcode Detector for Malicious Document Hunting
    (2017-01-01)
    Chen, Chong-Kuan
    ;
    Lan, Shen-Chieh
    ;
    Shieh, Shiuhpyng Winston
    ;
    資訊工程學系
    ;
    Department of Computer Science
    Advanced Persistent Threat (APT) attacks became a major network threat in recent years. Among APT attack techniques, sending a phishing email with malicious documents attached is considered one of the most effective ones. Although many users have the impression that documents are harmless, a malicious document may in fact contain shellcode to attack victims. To cope with the problem, we design and implement a malicious document detector called Forensor to differentiate malicious documents. Forensor integrates several open-source tools and methods. It first introspects file format to retrieve objects inside the documents, and then automatically decrypts simple encryption methods, e.g., XOR, rot and shift, commonly used in malware to discover potential shellcode. The emulator is used to verify the presence of shellcode. If shellcode is discovered, the file is considered malicious. The experiment used 9,000 benign files and more than 10,000 malware samples from a well-known sample sharing website. The result shows no false negative and only 2 false positives.
  • Thumbnail Image
    Item type:Item,
    Security Semantics Modeling with Progressive Distillation
    (2017-11-01)
    Shen, Zong-Xian
    ;
    Hsu, Chia-Wei
    ;
    Shieh, Shiuhpyng Winston
    ;
    資訊工程學系
    ;
    Department of Computer Science
    The prevalence of Android platform has attracted adversaries to craft malicious payloads for illegal profit. Such malicious artifacts are frequently reused and embedded in benign, paid apps to lure victims that the apps have been cracked for free. To discover these fraudulent apps, administrators of app markets desire an automated scanning process to maintain the health of app ecosystem. However, conventional approaches cannot be efficiently applied due to the lack of a scalable, effective approach to malware characteristics aggregation. On the other hand, the vast number of apps significantly increases the analysis complexity. In this paper, we propose Petridish which generates discriminative models against the repacked malicious apps. These representative models of malicious semantics can be progressively distilled with malign and benign samples. These models can further detect repacked malicious apps. Our experiment shows that, after two retraining rounds, Petridish achieved an average of 28 percent progressive detection improvement from 63 to 91.2 percent for the large families, exceeding 38 test samples in size. With noise reduction, it accomplished 88 percent detection rate and 1.7 percent false alarm rate. The characteristics aggregation approach will become critical in the age of app explosion.