Fighting Evasive Malware: How to Pass the Reverse Turing Test By Utilizing a VMI-Based Human Interaction Simulator
| dc.contributor.author | Gruber, Jan | |
| dc.contributor.author | Freiling, Felix C. | |
| dc.contributor.editor | Christian Wressnegger, Delphine Reinhardt | |
| dc.date.accessioned | 2023-01-24T11:17:52Z | |
| dc.date.available | 2023-01-24T11:17:52Z | |
| dc.date.issued | 2022 | |
| dc.description.abstract | Sandboxes are an indispensable tool in dynamic malware analysis today. However, modern malware often employs sandbox-detection methods to exhibit non-malicious behavior within sandboxes and therefore evade automatic analysis. One category of sandbox-detection techniques are reverse Turing tests (RTTs) to determine the presence of a human operator. In order to pass these RTTs, we propose a novel approach which builds upon virtual machine introspection (VMI) to automatically reconstruct the graphical user interface, determine clickable buttons and inject human interface device events via direct control of virtualized human interface devices in a stealthy way. We extend the VMI-based open-source sandbox DRAKVUF with our approach and show that it successfully passes RTTs commonly employed by malware in the wild to detect sandboxes | en |
| dc.identifier.doi | 10.18420/sicherheit2022_03 | |
| dc.identifier.isbn | 978-3-88579-717-3 | |
| dc.identifier.pissn | 1617-5468 | |
| dc.identifier.uri | https://dl.gi.de/handle/20.500.12116/40145 | |
| dc.language.iso | en | |
| dc.publisher | Gesellschaft für Informatik, Bonn | |
| dc.relation.ispartof | GI SICHERHEIT 2022 | |
| dc.relation.ispartofseries | Lecture Notes in Informatics (LNI) - Proceedings, Volume P-323 | |
| dc.subject | Malware Analysis | |
| dc.subject | Sandboxing | |
| dc.subject | Virtual Machine Introspection | |
| dc.subject | Reverse Turing Test | |
| dc.title | Fighting Evasive Malware: How to Pass the Reverse Turing Test By Utilizing a VMI-Based Human Interaction Simulator | en |
| dc.title.subtitle | How to Pass the Reverse Turing Test By Utilizing a VMI-Based Human Interaction Simulator | en |
| gi.citation.endPage | 64 | |
| gi.citation.startPage | 49 | |
| gi.conference.date | 5.-8. April 2022 | |
| gi.conference.location | Karlsruhe | |
| gi.conference.sessiontitle | Session 1 |
Dateien
Originalbündel
1 - 1 von 1
Vorschaubild nicht verfügbar
- Name:
- B1-3.pdf
- Größe:
- 388.38 KB
- Format:
- Adobe Portable Document Format