TC: Small: Collaborative Research: Scalable Malware Analysis Using Lightweight Virtualization

点击翻译按钮获取中文摘要

As the web continues to play an increasing role in informationexchange, so too is it becoming the prevailing platform for infectingvulnerable hosts. One commonly deployed strategy for deliveringweb-malware involves the underhanded tactic of targeting browservulnerabilities to automatically download and run malicious softwareupon visiting a website. When popular websites are exploited, thevictim base from these so-called drive-by downloads can be far greaterthan other forms of exploitation because traditional defenses (e.g.,firewalls) pose no barrier to infection. Unfortunately, with theplethora of (insecure) web applications being deployed today, it islikely that web servers will continue to be popular targets forexploitation for the foreseeable future.One of our primary goals is to take an in-depth look at the malwareserving network on the Web by building a scalable malware executionand analysis infrastructure. Specifically, we plan to build aresource-efficient host architecture that permits lightweight processmonitoring via tracking of interactions with the OS. An importantfacet of our research direction is to explore a transactionalframework that unifies virtualization and logging to allow efficientanalysis. In this framework, the granularity of recorded transactionsis dynamically adjusted based on execution contexts, aggregatingmultiple transactions to a single, summarized, transaction wheneverpossible. Broader impats of this project will result from thecomprehensive analysis of the different aspects of the problem posedby web-based malware, and the tools, methods, and analyticaltechniques that will ultimately allow for large-scale malware analysisby the security community at large.