🏛️國立陽明交通大學機構典藏

Search Results

Now showing 1 - 5 of 5

VMCloak: Toward a Stealthy in-VM Agent Execution
(2017-01-01)
Wang, Chiawei
;
Shieh, Shiuhpyng
;
交大名義發表
;
National Chiao Tung University
In-VM agent programs are generally used for the convenience of VM monitor in malware analysis. To prevent malicious interference, the stealthy execution of an in-VM agent is desirable. Existing approaches for stealthy execution of the agent remains detectable if libraries or kernel code of the guest OS is contaminated by malware. Moreover, the lack of applicability to conventional executables limits the agent functionality. In this paper, VMCloak is proposed for the stealthy in-VM agent execution. Our scheme leverages the virtualization technology to perform the real-time binary instrumentation to conceal the fingerprints of an in-VM agent from potential detection. Both stealthiness and integrity of the agent are guaranteed even when the guest OS is compromised. The evaluation shows that VMCloak can cope with the applicability issues, allowing the in-VM agent to perform the same operations as that of ordinary executables.
Shellcode Detector for Malicious Document Hunting
(2017-01-01)
Chen, Chong-Kuan
;
Lan, Shen-Chieh
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
Advanced Persistent Threat (APT) attacks became a major network threat in recent years. Among APT attack techniques, sending a phishing email with malicious documents attached is considered one of the most effective ones. Although many users have the impression that documents are harmless, a malicious document may in fact contain shellcode to attack victims. To cope with the problem, we design and implement a malicious document detector called Forensor to differentiate malicious documents. Forensor integrates several open-source tools and methods. It first introspects file format to retrieve objects inside the documents, and then automatically decrypts simple encryption methods, e.g., XOR, rot and shift, commonly used in malware to discover potential shellcode. The emulator is used to verify the presence of shellcode. If shellcode is discovered, the file is considered malicious. The experiment used 9,000 benign files and more than 10,000 malware samples from a well-known sample sharing website. The result shows no false negative and only 2 false positives.
Security Semantics Modeling with Progressive Distillation
(2017-11-01)
Shen, Zong-Xian
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
The prevalence of Android platform has attracted adversaries to craft malicious payloads for illegal profit. Such malicious artifacts are frequently reused and embedded in benign, paid apps to lure victims that the apps have been cracked for free. To discover these fraudulent apps, administrators of app markets desire an automated scanning process to maintain the health of app ecosystem. However, conventional approaches cannot be efficiently applied due to the lack of a scalable, effective approach to malware characteristics aggregation. On the other hand, the vast number of apps significantly increases the analysis complexity. In this paper, we propose Petridish which generates discriminative models against the repacked malicious apps. These representative models of malicious semantics can be progressively distilled with malign and benign samples. These models can further detect repacked malicious apps. Our experiment shows that, after two retraining rounds, Petridish achieved an average of 28 percent progressive detection improvement from 63 to 91.2 percent for the large families, exceeding 38 test samples in size. With noise reduction, it accomplished 88 percent detection rate and 1.7 percent false alarm rate. The characteristics aggregation approach will become critical in the age of app explosion.
IoT Security: Ongoing Challenges and Research Opportunities
(2014-01-01)
Zhang, Zhi-Kai
;
Cho, Michael Cheng Yi
;
Wang, Chia-Wei
;
Hsu, Chia-Wei
;
Chen, Chong-Kuan
The Internet of Things (IoT) opens opportunities for wearable devices, home appliances, and software to share and communicate information on the Internet. Given that the shared data contains a large amount of private information, preserving information security on the shared data is an important issue that cannot be neglected. In this paper, we begin with general information security background of IoT and continue on with information security related challenges that IoT will encountered. Finally, we will also point out research directions that could be the future work for the solutions to the security challenges that IoT encounters.
Can Malware Be Exterminated by Better Understanding Its Roots?
(2014-11-01)
Cho, Michael Cheng Yi
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng
;
Wang, Chi-Wei
;
資訊工程學系

學術出版;;Publications

Browse

Filters

Settings

Sort By

Results per page

🏛️國立陽明交通大學機構典藏

Search Results