MalTRAK: Tracking and Eliminating Unknown Malware
MalTRAK: Tracking and Eliminating Unknown Malware
复制标题
MalTRAK：跟踪和消除未知恶意软件
DOI：
--
复制
发表时间：
2008
期刊：
影响因子：
--
通讯作者：
Amit Vasudevan
中科院分区：
文献类型：
--
作者：
Amit Vasudevan
恶意软件或恶意代码正在迅速演变为对计算社区的威胁。零日恶意软件在被发现后很快就会利用漏洞，并迅速传播。然而，作为最广泛使用的对抗机制的反病毒工具，却无法应对这一点。它们基于需要为新的恶意软件菌株计算的签名。在新的恶意软件攻击之后，在找到签名之前，允许恶意软件有足够的时间执行其破坏。我们提出了一个新的框架，代号为MalTRAK，当部署在一个干净的系统上时，它保证了已知或未知恶意软件的任何影响总是可以逆转的，并且系统可以恢复到以前的干净状态。我们的框架还维护了详细的系统操作依赖列表，可用于进一步的取证分析。我们能够实现这一点，而不会对用户可以执行的程序的性质施加任何限制，也不会让用户注意到由于该框架而导致的任何可感知的系统减速。此外，我们能够跟踪对系统的修改，确保始终可以监控系统状态的任何更改，即使恶意软件在执行过程中修改了系统。我们在Windows上实现并评估了MalTRAK，使用了8个已知恶意软件，假设它们是未知的菌株。然后，我们将我们的结果与两个流行的商业反病毒工具进行了比较。我们能够成功地恢复8个恶意软件的所有影响，而商业工具平均只能恢复它们所有影响总和的36%。对于其中一个恶意软件样本，商业工具只能检测到它，但无法修复它的任何损坏。此外，对于其中两个恶意软件样本，商业工具完全无法检测或恢复其任何影响。我们的结果表明，基于特征码的机制除了不能防止新的恶意软件株的感染外，即使在特征码已经开发出来之后，也不能非常有效地删除感染。我们的经验表明，非基于签名的方法，如MalTRAK，是对抗不断演变的恶意软件威胁的下一步。
Malware or malicious code is a rapidly evolving threat to the computing community. Zero-day malware are exploiting vulnerabilities very soon after being discovered and are spreading quickly. However, anti-virus tools, which are the most widely used countering mechanism, are unable to cope with this. They are based on signatures which need to be computed for new malware strains. After a new malware strikes and before the signature is found allows sufficient time for the malware to perform its damage. We propose a new framework, codenamed MalTRAK, which, when deployed on a clean system, guarantees that any effects of a known or unknown malware can always be reversed and the system can be restored back to a prior clean state. Our framework also maintains detailed dependency lists of system operations which can be used for further forensic analysis. We are able to achieve this without imposing any restrictions on the nature of programs that can be executed by the user and without the user noticing any perceptible system slowdown due to the framework. Furthermore, we are able to track modifications to the system at a level that ensures that we can always monitor any changes to the system state even if a malware modifies the system during execution. We implemented and evaluated MalTRAK on Windows, using 8 known malware assuming they were unknown strains. We then compared our results with two popular commercial anti-virus tools. We were able to successfully restore all the effects of the 8 malware, while the commercial tools, on an average were only able to restore 36% of all their effects put together. For one of the malware samples, the commercial tools could only detect it but could not repair any of its damage. Further, for two of the malware samples, the commercial tools were completely unable to detect or restore any of their effects. Our results show that signature based mechanisms in addition to not being able to prevent infection by new malware strains, are not very effective in removing an infection even after a signature has been developed. Our experience shows that non-signature based approaches, such as MalTRAK, are the next step towards combating the threat of ever-evolving malware.