ConcSpectre: Be Aware of Forthcoming Malware Hidden in Concurrent Programs
ConcSpectre: Be Aware of Forthcoming Malware Hidden in Concurrent Programs
复制标题
ConcSpectre：警惕并发程序中隐藏的即将到来的恶意软件
DOI：
10.1109/tr.2022.3162694
复制
发表时间：
2022-06
期刊：
影响因子：
--
通讯作者：
Ting Liu
中科院分区：
文献类型：
--
作者：
Yang Liu;Zisen Xu;Ming Fan;Yu Hao;Kai Chen;Hao Chen;Yan Cai;Zijiang Yang;Ting Liu
多线程并行执行的并发程序被广泛用于释放多核计算系统的能力。由于并发程序的复杂性，很多研究都集中在对并发程序的测试和调试上。除了正确性之外，我们还发现安全性也会受到并发的影响。在本文中，我们提出了并发程序幽灵(ConcSpectre)，这是一种新的安全威胁，它将恶意软件隐藏在不确定的线程交织中。为了展示这种威胁，我们开发了一种称为并发逻辑炸弹的隐形恶意软件技术，它通过分割一段恶意代码并将其组件单独注入到并发程序中。恶意行为可由正常执行环境中很少发生的某些线程交叉(例如，$<；$1%)触发。然而，使用一种名为可控概率激活的新技术，我们可以通过远程干扰线程调度来以非常高的概率(例如$&>$90%)激活此类ConcSpectre恶意软件。在评估中，生成了1000多个ConcSpectre样本，绕过了VirusTotal中的大多数反病毒引擎和四个知名的在线动态恶意软件分析系统。我们还演示了如何在Web服务器上远程触发ConcSpectre样本并控制其激活概率。我们的工作表明，迫切需要针对并发程序的新的恶意软件分析方法。
Concurrent programs with multiple threads executing in parallel are widely used to unleash the power of multicore computing systems. Owing to their complexity, a lot of research focuses on testing and debugging concurrent programs. Besides correctness, we find that security can also be compromised by concurrency. In this article, we present concurrent program spectre (ConcSpectre), a new security threat that hides malware in nondeterministic thread interleavings. To demonstrate such threat, we have developed a stealth malware technique called concurrent logic bomb by partitioning a piece of malicious code and injecting its components separately into a concurrent program. The malicious behavior can be triggered by certain thread interleavings that rarely happen (e.g., $< $1%) under a normal execution environment. However, with a new technique called controllable probabilistic activation, we can activate such ConcSpectre malware with a very high probability (e.g., $>$90%) by remotely disturbing thread scheduling. In the evaluation, more than 1000 ConcSpectre samples are generated, which bypassed most of the antivirus engines in VirusTotal and four well-known online dynamic malware analysis systems. We also demonstrate how to remotely trigger a ConcSpectre sample on a web server and control its activation probability. Our work shows an urgent need for new malware analysis methods for concurrent programs.
登录
查看更多内容
影响因子：
35.6
作者：
Ethan M. Rudd;Andras Rozsa;Manuel Günther;T. Boult
通讯作者：
Ethan M. Rudd;Andras Rozsa;Manuel Günther;T. Boult
DOI：
10.1145/3236024.3236028
发表时间：
2018-07
期刊：
Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering
影响因子：
--
作者：
Shengjian Guo;Meng Wu;Chao Wang
通讯作者：
Shengjian Guo;Meng Wu;Chao Wang
DOI：
10.1007/978-3-540-73614-1_6
发表时间：
2007-07
期刊：
--
影响因子：
--
作者：
Elizabeth Stinson;John C. Mitchell
通讯作者：
Elizabeth Stinson;John C. Mitchell
告诉你肯定的答案：线程调度时你的数据是否被污染
影响因子：
7.4
作者：
Zhang.Xiaodong;Yang.Zijiang;Zheng.Qinghua;Hao.Yu;Liu.Pei;Liu.Ting
通讯作者：
Liu.Ting
像顺序调试一样调试多线程程序
影响因子：
3.9
作者：
Zhang Xiaodong;Yang Zijiang;Zheng Qinghua;Hao Yu;Liu Pei;Yu Lechen;Liu Ting
通讯作者：
Liu Ting