malware detection using advanced behavior analysis

9

Copyright (c) 2012, FireEye, Inc. All rights reserved. 1 Malware Detection using Advanced Behavior Analysis Josh McCarthy, Sr. Solutions Architect

Upload: others

Post on 12-Sep-2021

7 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 1

Malware Detection using Advanced Behavior Analysis

Josh McCarthy, Sr. Solutions Architect

Page 2: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 2

Multi-protocol Object Capture

FireEye Appliance Platform

MALWARE-VM FILTER

Multi-Protocol, Real-Time VX Engine

Virtual Execution Environments Phase 2

Phase 1 – Web MPS •  Aggressive Capture •  Web Object Filter M

ap To Target O

S&A

pps

Phase 1 – Email MPS •  Email Attachments •  URL Submission

Phase 1 – MAS appliance •  User submissions •  Batch mode processing

Page 3: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 3

Sample Web Exploit

Pcap, and original object(s)

Page 4: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 4

DLL Entry Points

Signature-less detection of zero-day attack

Malicious binary download posing as JPG

Page 5: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 5

Recent PDF Zero-Day Sleep Example

Tracking sleep call

Page 6: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 6

MAS Object and Info Availability

Pcap, extracted files, clip, & original object(s)

Extracted C2 information

Full dynamic analysis information

Page 7: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 7

FireEye Security Assessment

http://www.fireeye.com/stopapts

Page 8: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 8

How to Detect Advanced Malware

•  Implement automated behavior analysis of inbound network traffic using virtual analysis techniques –  Analyze multiple version of Adobe files and Microsoft Office files –  Java exploits –  DLL injects –  Heap spray attacks

•  Implement automated mechanisms to discover Call-back Channels via behavioral analysis

•  Implement automated dynamic behavior analysis mechanism to evaluate email attachments and URLs to identify and protect against targeted spear phishing attacks

Page 9: Malware Detection using Advanced Behavior Analysis

Copyright (c) 2012, FireEye, Inc. All rights reserved. 9

FireEye Advanced Malware Protection

Practical Malware Analysis: Ch 11: Malware Behavior

Malware Detection With Multiple Features

Scalable, Behavior-Based Malware Clustering

On detection methods and analysis of malware › ~async › CCIS › talk_12 › VirusDetectionMethods.pdfOn detection methods and analysis of malware 1. A quick tour of Malware detection

Data Mining for Malware Detection

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Graph Techniques for Malware Detection

Malware Detection and Classification

Analyzing Malware Detection Efficiency with Multiple Anti-Malware Programs

Automating Malware Detection by Inferring Intent · Automating Malware Detection by Inferring Intent Weidong Cui ... Automating Malware Detection by Inferring Intent by Weidong Cui

Anomaly-BaseD Malware detection

Malware Detection using Machine Learning

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Behavior-Based Malware Detection

Investigation on Sharing Signatures of Suspected Malware ... · Malware detection techniques are roughly divided into three types: signature-based methods, behavior-based meth-ods,

Detection of APT Malware through External and … of APT Malware through External and Internal Network Tra c ... ’Detection of APT Malware through External and ... 1.3.1 Detection

Lastline Breach Detection Platform - Abbakan€¦ · malware behavior and is also the hardest for evasive malware to circumvent. The result is the successful detection of malicious

Behavior-Based Malware Detection Somesh Jha University of Wisconsin, Madison

Malware detection with OSSEC @santiagobassett. Setting up a malware lab Collection Analysis Detection @santiagobassett

EW DEEPLEARNING-BASED MALWARE INTRUSION : T MALWARE ... › pdf › 1907.08356v1.pdf · Similarity Algorithm to achieve abnormal behavior detection. Y. Ye Et al also proposed a similar

Malware Classification And Detection

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

FB Malware Detection

A Survey of Malware Detection Techniques · 2017-03-29 · through the manifested malware detection technique(s), and serves as an empirical means of evaluating malware detection

Polymorphic Malware Detection

1 MADAM: Effective and Efﬁcient Behavior-based …...1 MADAM: Effective and Efﬁcient Behavior-based Android Malware Detection and Prevention Andrea Saracino, Daniele Sgandurra,

Malware Detection API - Qualys · Chapter 2 MD API Search malware ... 21 Current malware detection count ... Using the Qualys Malware Detection (MD) API, third parties can integrate

Malware detection

Analyzing Malware Detection Effectiveness with Multiple Anti-Malware Programs

Malware Detection based on Application Behavior Modeling

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Malware Detection Based on Permissions on Android Platform ... · installing the applications to monitor the malware behavior, or by taking actions after installing the application

Skeleton key malware detection owasp

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

A Behavior-based Methodology for Malware Detection