King Abdulaziz University Cant Live Without Them Paper Your paper review should be at most 2 pages in length, using 1.5 spacing and font size of 12 in Time

King Abdulaziz University Cant Live Without Them Paper Your paper review should be at most 2 pages in length, using 1.5 spacing and font size of 12 in Times New Roman You will review one of the papers you selected (We Can’t Live Without Them) . The importance of
the paper reviews is to learn how scientific papers are written and learn how the papers are peerreviewed. When you learn how papers are critiqued, you will be writing good scientific papers. As
masters students, you will always have opportunities to be peer reviewers to conferences, workshops,
and symposiums where you present your papers.
Your paper review should be at most 2 pages in length, using 1.5 spacing and font size of 12 in Times
New Roman. Make sure that the critique is written in your own words avoid plagiarizing the paper you
are reviewing. Below is the rubric I will use to grade your paper review.
6
A Survey on Automated Dynamic Malware-Analysis
Techniques and Tools
MANUEL EGELE, Vienna University of Technology
THEODOOR SCHOLTE, SAP Research, Sophia Antipolis
ENGIN KIRDA, Institute Eurecom, Sophia Antipolis
CHRISTOPHER KRUEGEL, University of California, Santa Barbara
Anti-virus vendors are confronted with a multitude of potentially malicious samples today. Receiving thousands of new samples every day is not uncommon. The signatures that detect confirmed malicious threats are
mainly still created manually, so it is important to discriminate between samples that pose a new unknown
threat and those that are mere variants of known malware.
This survey article provides an overview of techniques based on dynamic analysis that are used to analyze
potentially malicious samples. It also covers analysis programs that employ these techniques to assist human
analysts in assessing, in a timely and appropriate manner, whether a given sample deserves closer manual
inspection due to its unknown malicious behavior.
Categories and Subject Descriptors: K.6.5 [Management of Computing and Information Systems]:
Security and Protection
General Terms: Security
Additional Key Words and Phrases: Dynamic analysis, malware
ACM Reference Format:
Egele, M., Scholte, T., Kirda, E., and Kruegel, C. 2012. A survey on automated dynamic malware-analysis
techniques and tools. ACM Comput. Surv. 44, 2, Article 6 (February 2012), 42 pages.
DOI = 10.1145/2089125.2089126 http://doi.acm.org/10.1145/2089125.2089126
1. INTRODUCTION
The Internet has become an essential part of daily life as more and more people use
services that are offered on the Internet. The Internet has evolved from a basic communication network to an interconnected set of information sources enabling, new forms
of (social) interactions and marketplaces for the sale of products and services among
other things. Online banking or advertising are examples of the commercial aspects
of the Internet. Just as in the physical world, there are people on the Internet with
malevolent intents, who strive to enrich themselves by taking advantage of legitimate
users whenever money is involved. Malware (i.e., software of malicious intent) helps
these people accomplish their goals.
To protect legitimate users from these threats, security vendors offer tools that aim
to identify malicious software components. Typically, these tools apply some sort of
signature matching process to identify known threats. This technique requires the
This work has been supported by the European Commission through project FP7-ICT-216026-WOMBAT, by
FIT-IT through the SECoverer project, and by Secure Business Austria.
Corresponding author’s address: M. Egele, Automation Systems Group (E183-1), Vienna University of Technology, Treitlstr. 1, 1040 Vienna, Austria; email: manuel@seclab.tuwien.ac.at.
Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted
without fee provided that copies are not made or distributed for profit or commercial advantage and that
copies show this notice on the first page or initial screen of a display along with the full citation. Copyrights for
components of this work owned by others than ACM must be honored. Abstracting with credit is permitted.
To copy otherwise, to republish, to post on servers, to redistribute to lists, or to use any component of this
work in other works requires prior specific permission and/or a fee. Permissions may be requested from
Publications Dept., ACM, Inc., 2 Penn Plaza, Suite 701, New York, NY 10121-0701 USA, fax +1 (212)
869-0481, or permissions@acm.org.
c 2012 ACM 0360-0300/2012/02-ART6 $10.00

DOI 10.1145/2089125.2089126 http://doi.acm.org/10.1145/2089125.2089126
ACM Computing Surveys, Vol. 44, No. 2, Article 6, Publication date: February 2012.
6:2
M. Egele et al.
vendor to provide a database of signatures which are then compared against potential
threats. Once the security vendor obtains a sample of a new potential threat to study,
the first step is for a human analyst to determine whether this (so far unknown)
sample poses a threat to users by analyzing the sample. If the sample poses a threat,
the analyst attempts to find a pattern that allows her to identify this sample (i.e., the
signature). This pattern should be generic enough to also match with variants of the
same threat, but not falsely match on legitimate content. The analysis of malware
and the successive construction of signatures by human analysts is time-consuming
and error-prone. It is also trivial for malware authors to automatically generate a
multitude of different malicious samples derived from a single malware instance. It is
not extraordinary for an anti-virus vendor to receive thousands of unknown samples per
day. Symantec [Fossi et al. 2009] (averaging 4,300 per day) as well as McAfee [Marcus
et al. 2009] (averaging 12,300 per day) report receiving over 1.6M new samples in 2008.
This substantial quantity requires an automated approach to quickly differentiating
between samples that deserve closer (manual) analysis and those that are a variation
of an already known threats. This automatic analysis can be performed in two ways.
Dynamic analysis refers to techniques that execute a sample and verify the actions this
sample performs in practice, while static analysis performs its task without actually
executing the sample.
This article focuses on the techniques that can be applied to analyze potential threats
and discriminate samples that are mere variations of already known threats. In addition, it presents the currently available tools and their underlying approaches to
performing automated dynamic analysis on potentially malicious software.
2. WHAT IS MALWARE?
Software that “deliberately fulfills the harmful intent of an attacker” is commonly
referred to as malicious software or malware [Moser et al. 2007a]. Terms such as
“worm,” “virus,” or “Trojan horse” are used to classify malware samples that exhibit
similar malicious behavior. The first instances of malicious software were viruses.
The motivation for the creators of such early malware was usually to highlight some
security vulnerabilities or simply to show off technical ability. For example, the cleaning
of Bagle worm-infected hosts by instances of the Netsky worm could be considered a
rivalry between different authors [Tanachaiwiwat and Helmy 2006]. As time passed,
the motivations changed. Today there is a flourishing underground economy based on
malware [Zhuge et al. 2008]. It is no longer the fun factor that drives the development
in these circles, but the prospect of money that can be made.
Consider the following scenario which illustrates the distribution of malware and its
effects. A bot is a remotely-controlled piece of malware that has infected an Internetconnected computer system. This bot allows an external entity, the so-called bot master,
to remotely control this system. The pool of machines that are under control of the bot
master is called a botnet. The bot master might rent this botnet to a spammer who
misuses the bots to send spam emails containing links to a manipulated webpage.
This page, in turn, might surreptitiously install a spyware component on a visitors
system which collects personal information, such as credit card numbers and online
banking credentials. This information is sent back to the attacker who is now able to
misuse the stolen information by purchasing goods online. All involved criminals make
money at the expense of the infected user, or her bank, respectively. With the rise of
the Internet and the number of attached hosts, it is now possible for a sophisticated
attacker to infect thousands of hosts within hours after releasing the malware into the
wild [Moore et al. 2002]. Recently, a study by Stone-Gross et al. [2009] revealed that
the Torpig botnet consists of more than 180,000 infected computer systems.
ACM Computing Surveys, Vol. 44, No. 2, Article 6, Publication date: February 2012.
A Survey on Automated Dynamic Malware-Analysis Techniques and Tools
6:3
The risk described above motivates the need to create tools that support the detection
and mitigation of malicious software. Nowadays, the weapon of choice in combat against
malicious software is signature-based anti-virus scanners that match a pregenerated
set of signatures against the files of a user. These signatures are created in a way
so that they only match malicious software. This approach has at least two major
drawbacks. First, the signatures are commonly created by human analysts. This often
is a tedious and error-prone task. Second, the usage of signatures inherently prevents
the detection of unknown threats for which no signatures yet exist. Thus, whenever a
new threat is detected, it needs to be analyzed, and signatures need to be created for
this threat. After the central signature database has been updated, the new information
needs to be deployed to all clients that rely on that database. Because the signatures
are created by human analysts, unfortunately, there is room for error. Multiple AV
vendors released signature updates that mistakenly identified legitimate executables
as malware [FRISK Software International 2003; John Leyden (The Register) 2007],
thus rendering the operating system they were designed to protect, inoperative.
Closely related to the second drawback (i.e., not being able to detect unknown
threats), is the inability to detect specifically tailored malware. Besides the mass phenomenon of Internet worms and malicious browser plug-ins, one can observe the existence of specifically tailored malware created for targeted attacks [Avira Press Center
2007]. Spyware programs may be sent via email to the executive board of a company
with the specific intent to capture sensitive information regarding the company. Because these malware samples usually do not occur in the wild, it is unlikely that an
anti-virus vendor receives a sample in time to analyze it and produce signatures. This
means that the spyware could be operational in the company for a long time before it
is detected and removed, even if anti-virus software is in place.
The inability to detect unknown threats is an inherent problem of signature-based
detection techniques. This is overcome by techniques that base their decision of identifying a piece of code as being malicious or not, on the observation of the software’s
behavior. Although these techniques allow for the detection of previously unknown
threats to a certain extent, they commonly suffer from false positives. That is, legitimate samples are falsely classified by the detection system as being malicious due
to the detector’s inability to distinguish legitimate from malicious behavior under all
circumstances.
2.1. Types of Malware
This section gives a brief overview of the different classes of malware programs that
have been observed in the wild. The following paragraphs are solely intended to familiarize the reader with the terminology that we will be using in the remainder of this
work. Furthermore, these classes are not mutually exclusive. That is, specific malware
instances may exhibit the characteristics of multiple classes at the same time. A more
detailed discussion of malicious code in general can be found in Skoudis and Zeltser
[2003] or Szor [2005].
Worm. Prevalent in networked environments, such as the Internet, Spafford [1989]
defines a worm as “a program that can run independently and can propagate a fully
working version of itself to other machines.” This reproduction is the characteristic
behavior of a worm. The Morris Worm [Spafford 1989] is the first publicly known
instance of a program that exposes worm-like behavior on the Internet. More recently
in July 2001, the Code Red worm infected thousands (359,000) of hosts on the Internet
during the first day of its release [Moore et al. 2002]. Today, the Storm worm and others
are used to create botnets that are rented out by bot masters to send spam emails or
perform distributed denial of service attacks (DDOS) [Kanich et al. 2008], in which
ACM Computing Surveys, Vol. 44, No. 2, Article 6, Publication date: February 2012.
6:4
M. Egele et al.
multiple worm-infected computers try to exhaust the system resources or the available
network bandwith of a target in a coordinated manner.
Virus. “A virus is a piece of code that adds itself to other programs, including operating
systems. It cannot run independently—it requires that its ‘host’ program be run to
activate it.” [Spafford 1989]. As with worms, viruses usually propagate themselves by
infecting every vulnerable host they can find. By infecting not only local files but also
files on a shared file server, viruses can spread to other computers as well.
Trojan Horse. Software that pretends to be useful but performs malicious actions in
the background is called a Trojan horse. While a Trojan horse can disguise itself as
any legitimate program, frequently, they pretend to be useful screensavers, browser
plug-ins, or downloadable games. Once installed, their malicious part might download
additional malware, modify system settings, or infect other files on the system.
Spyware. Software that retrieves sensitive information from a victim’s system and
transfers this information to the attacker is denoted as spyware. Information that
might be interesting for the attacker include accounts for computer systems or bank account credentials, a history of visited web pages, and contents of documents and emails.
Bot. A bot is a piece of malware that allows its author (i.e., the bot master) to remotely
control the infected system. The set of bots collectively controlled by one bot master
is a botnet. Bots are commonly instructed to send spam emails or perform spyware
activities as just described.
Rootkit. The main characteristic of a rootkit is its ability to hide certain information
(i.e., its presence) from a user of a computer system. Rootkit techniques can be applied
at different system levels, for example, by instrumenting API calls in user-mode or
tampering with operating system structures if implemented as a kernel module or device driver. Manipulating the respective information allows a rootkit to hide processes,
files, or network connections on an infected system. Moreover, virtual machine-based
rootkits [King et al. 2006; Rutkowska 2006; Zovi 2006] conceal their presence by migrating an infected operating system onto a virtual machine. The hiding techniques
of rootkits are not bad per se, but the fact that many malware samples apply rootkit
techniques to hide their presence in the system justifies mentioning them here.
2.2. Infection Vectors
This section gives an overview of the infection vectors commonly used by malicious
software to infect a victim’s system. Brief examples are used to illustrate how these
infections work and how malware used them in the past.
2.2.1. Exploiting Vulnerable Services over the Network. Network services running on a
server provide shared resources and services to clients in a network. For example,
a DNS service provides the capabilities of resolving host names to IP addresses, and
a file server provides shared storage on the network. Many commodity off-the-shelf
operating systems come with a variety of network services that are already installed
and running. Vulnerabilities in such services might allow an attacker to execute code
on the machine that is providing the service. Large installation bases of services that
share the same vulnerability (e.g., [Microsoft Corporation 2008]) paved the way for
automatic exploitation. Thus, such conditions allow malicious software to infect accessible systems automatically. This characteristic makes network service exploitation the
preferred method for infection by worms. Moreover, services that provide system access
to remote users and authenticate these users with passwords (e.g., ssh, administrative
Web interfaces, etc.), are frequently exposed to so-called dictionary attacks. Such an
attack iteratively tries to log into a system using passwords stored in a dictionary.
2.2.2. Drive-by Downloads. Drive-by downloads usually target a victim’s Web browser.
By exploiting a vulnerability in the Web browser application, a drive-by download is
ACM Computing Surveys, Vol. 44, No. 2, Article 6, Publication date: February 2012.
A Survey on Automated Dynamic Malware-Analysis Techniques and Tools
6:5
able to fetch malicious code from the Web and subsequently execute it on the victim’s
machine. This usually happens without further interaction with the user. In contrast
to exploiting vulnerabilities in network services in which push-based infection schemes
are dominant, drive-by downloads follow a pull-based scheme [Provos et al. 2008]. That
is, the connections are initiated by the client as it is actively requesting the malicious
contents. Therefore, firewalls that protect network services from unauthorized access
cannot mitigate the threat of drive-by attacks. Currently, the following two techniques
are observed in the wild which might lead to drive-by infections.
—API misuse. If a certain API allows for downloading an arbitrary file from the Internet, and another API provides the functionality of executing a random file on
the local machine, the combination of these two APIs can lead to a drive-by infection [Microsoft Corporation 2006]. The widespread usage of browser plug-ins usually
gives attackers a huge portfolio of APIs that they might use and combine for their
nefarious purposes in unintended ways.
—Exploiting Web browser vulnerabilities. This attack vector is identical to the case of
exploitable network services. Moreover, as described in Daniel and Sotiroy [2008],
the availability of client-side scripting languages, such as Javascript or VBScript,
provide the attacker with additional means to successfully launch an attack.
Before a drive-by download can take place, a user is first required to visit the malicious site. In order to lure the user into visiting the malicious site, attackers perform
social engineering and send spam emails that contain links to these sites or infect
existing webpages with the malicious code. For example, the infamous Storm worm
makes use of its own botnet resources to send spam emails containing links to such
attack pages [Kanich et al. 2008].
To maximize the number of sites that host such drive-by attacks, attackers exploit
vulnerabilities in Web applications that allow them to manipulate these websites (e.g.,
[Dan Goodin (The Register) 2008]). This is an example in which attackers use the
infection vector of vulnerable network services to launch drive-by download attacks on
clients of that service (e.g., a website). Another technique for attackers to lure users to
their websites is by trying to cheat the ranking algorithms Web search engines use,
to sort result pages. An attacker may create a page that is specifically instrumented
to rank high for common search query terms. If the page is listed on a top position
for these query terms, it will result in a large number of visitors [Cacheda and Viña
2001; Jansen and Spink 2005]. Provos et al. [2008] discovered that mor…
Purchase answer to see full
attachment