TWC: Small: Combating Environment-aware Malware

用于动态检测诸如反病毒软件之类的恶意软件(恶意软件)的工具通常创建受保护的“分析环境”(或“沙盒”)，在该环境中测试可疑软件而不会对计算机系统造成风险。恶意软件作者的回应是开发环境感知技术，使他们的恶意软件能够识别沙箱环境中的不同行为并以不同的方式运行，从而逃避检测。防御软件的作者正在努力确保分析环境显示出现实的特征。该项目专注于检查“磨损”或“老化”伪像，这些伪像的缺失使恶意软件能够将原始的、新的分析环境与已被视为正常使用的真实环境区分开来。该项目正在评估一类新的环境感知恶意软件的可能性，该类恶意软件利用由于正常使用而不可避免地出现在真实系统上的与使用相关的伪像，并且这些伪像在现有恶意软件分析环境中是不存在的。该项目首先调查识别与过去用户活动相关的人工产物的技术，并研究恶意软件可能如何查询或探测以获取此类信息。其次，研究人员正在评估这些技术对当前动态恶意软件分析系统的有效性，以及此类防御系统如何检测对环境信息的查询或探测表明存在恶意软件。最后，该项目正在研究是否可以将人工创建的“磨损”人工制品注入分析环境，以对抗下一代具有环境意识的恶意软件。

Tools for dynamic detection of malicious software ("malware"), such as antivirus software, often create a protected "analysis environment" (or "sandbox") in which to test suspicious software without risk to the computer system. Malware authors have responded by developing environment-awareness techniques, to enable their malware to recognize and behave differently in a sandbox environment, thereby evading detection. Authors of defense software are endeavoring to ensure that analysis environments exhibit realistic characteristics. This project focuses on examining "wear-and-tear" or "aging" artifacts, whose absence could enable malware to distinguish a pristine, new analysis environment from a real environment that has been seen normal use.This project is assessing the potential for a new class of environment-aware malware that exploits usage-related artifacts that inevitably occur on real systems as a result of normal use, and which are absent in existing malware analysis environments. The project is first investigating techniques for recognizing artifacts related to past user activity and studying how malware might query or probe to acquire such information. Second, the researchers are evaluating the effectiveness of these techniques against current dynamic malware analysis systems and how such defense systems might detect that queries or probes of environmental information indicate the presence of malware. Finally, the project is studying whether artificially created "wear and tear" artifacts might be injected into analysis environments to counter next-generation, environment-aware malware.