| 摘要(英) |
In the near several decades, the arms race between malware writers and system security watchmen has become more and more severe. The simplest way for a user to secure her/his computer while using it is to install antivirus software on her/his computer. As antivirus software becomes more sophisticated and powerful, evading the detection of antivirus software becomes an important part of malware. Without a good approach to bypass the detection of antivirus software, before doing any vicious activity, malware may have already been removed by antivirus software.
As a result, malware writers have developed various approaches to increase the survivability and stealth of their malware. And many malware self-defense technologies have been implemented. One of these technologies is to disrupt the functionality of security solutions, especially antivirus software. For example, lot of malware terminates antivirus software right after their execution. Without the protection of the terminated security tool, an attacker can do anything on the intruded host.
In this paper, we propose a mechanism, called ANtivirus Software Shield (ANSS), to prevent antivirus software from being terminated without the consciousness of the antivirus software users. ANSS uses SSDT hook to intercept specific Windows APIs and analyzes them to filter out hazardous API calls that will viciously terminate antivirus software. Experimental results show that ANSS can protect antivirus software from being terminated by malware used in our experiments with at most 3.5% performance overhead.
|
| 參考文獻 |
[1] Kerivan, J.E. and Brothers, K. Self-Defending Security Software. In Military Communications Conference, 2005
[2] Nima Bagheri Anti Anti-Virus; Disable Anti Virus services. In MalCon, 2010
[3] Alsagoff, S. Malware self protection mechanism. In ITSim, 2008
[4] Microsoft Corp., Overview of the Windows API http://msdn.microsoft.com/en-us/library/Aa383723
[5] Microsoft Corp., Introduction to Win32/Win64 http://technet.microsoft.com/en-us/library/bb496995.aspx
[6] Wikipedia - Windows API http://en.wikipedia.org/wiki/Windows_API
[7] Sven Schreiber, Undocumented Windows 2000 Secrets: A Programmer's Cookbook, Addison-Wesley Professional, 2001
[8] 張帆,史彩成, Windows Driver Development Internals, Publishing House of Electronics Industry, 2008
[9] AV comparatives – Security survey http://www.av-comparatives.org
[10] OPSWAT – Market share report http://www.opswat.com/media/reports
[11] W3schools.com – OS platform statistics http://www.w3schools.com/browsers/browsers_os.asp
[12] Anubis – Analyzing unknown binaries http://anubis.iseclab.org/
[13] Wikipedia – Windows Registry http://en.wikipedia.org/wiki/Windows_Registry
[14] PassMark Software – Performance Test http://www.passmark.com/products/pt.htm
[15] Salvatore J. Stolfo, Frank Apap, Eleazar Eskin, Katherine Heller, Shlomo Hershkop, Andrew Honig, and Krysta Svore, A Comparative Evaluation of Two Algorithms for Windows Registry Anomaly Detection, Journal of Computer Security, 2005
[16] DiamondCS – RegistryProt http://www.diamondcs.com.au/index.php
[17] Mikko Technology - Registry Protecto http://www.mikkotech.com/
[18] DeviceLock – Active Registry Monitor http://www.devicelock.com/
[19] Ashampoo – Registry Cleaner http://www.ashampoo.com/en/usd
[20] J. Butler and G. Hoglund, VICE–catch the hookers, Black Hat USA, July 2004
[21] IceSword. http://www.antirootkit.com/software/IceSword.htm
[22] J. Rutkowska, System virginity verifier: Defining the roadmap for malware detection on windows systems, Hack in the Box Security Conference, September 2005
[23] Heng Yin, Zhenkai Liang, Dawn Song, HookFinder: Identifying and Understanding Malware Hooking Behaviors, 15th Annual Network and Distributed System Security Symposium (NDSS), February 2008
[24] Muhammad Aslam, Rana Naveed Idrees, Mirza Muzammil Baig, and Muhammad Asif Arshad, Anti-Hook Shield against the Software Key Loggers, Proc. of Nat. Conf. of Emerging Technologies, 2004
[25] C. K. Tan, Defeating Kernel Native API Hookers by Direct Service Dispatch Table Restoration,http://www.security.org.sg/code/SIG2_DefeatingNativeAPIHookers.pdf, July 2004.
[26] Windows – Protected Process in Windows Vista http://msdn.microsoft.com/en-us/windows/hardware/gg463417
[27] ProcessGuard http://www.diamondcs.com.au/index.php
[28] Szor, Peter, The Art Of Computer Virus Research And Defense, Addison Wesley Professional, Maryland, 2005
[29] SECURELIST - The evolution of self-defense technologies in malware http://www.securelist.com/en/analysis?pubid=204791949
[30] Symeon D Xenitellis, A New Avenue of Attack: Event-driven System Vulnerabilities, European Conference in Information Warfare, July, 2002
|
[Endnote RIS 格式]
[相關文章]
[文章引用]
[完整記錄]
[館藏目錄]
至系統瀏覽論文 ( 永不開放)
plurk
funp
live
udn
HD
myshare
netvibes
friend
youpush
delicious
baidu
Google bookmarks
del.icio.us
hemidemi
facebook
twitter
google
reddit