TWC: Small: Combating Environment-aware Malware

用于动态检测恶意软件（“malware”）的工具（诸如防病毒软件）通常创建受保护的“分析环境”（或“沙箱”），在该环境中测试可疑软件而不对计算机系统造成风险。恶意软件作者通过开发环境感知技术来应对，以使他们的恶意软件能够在沙箱环境中识别和表现不同，从而逃避检测。国防软件的作者正在努力确保分析环境表现出真实的特性。 该项目的重点是检查“磨损”或“老化”工件，如果没有这些工件，恶意软件就可以将原始的新分析环境与正常使用的真实的环境区分开来。该项目正在评估一类新的环境感知恶意软件的潜力，这些恶意软件利用与使用相关的工件，这些工件不可避免地出现在真实的系统上，作为正常使用的结果，并且在现有的恶意软件分析环境中不存在。该项目首先研究识别与过去用户活动相关的工件的技术，并研究恶意软件如何查询或探测以获取此类信息。 其次，研究人员正在评估这些技术对当前动态恶意软件分析系统的有效性，以及这些防御系统如何检测到环境信息的查询或探测表明恶意软件的存在。 最后，该项目正在研究是否可以将人工创建的“磨损”工件注入分析环境中，以对抗下一代环境感知恶意软件。

Tools for dynamic detection of malicious software ("malware"), such as antivirus software, often create a protected "analysis environment" (or "sandbox") in which to test suspicious software without risk to the computer system. Malware authors have responded by developing environment-awareness techniques, to enable their malware to recognize and behave differently in a sandbox environment, thereby evading detection. Authors of defense software are endeavoring to ensure that analysis environments exhibit realistic characteristics. This project focuses on examining "wear-and-tear" or "aging" artifacts, whose absence could enable malware to distinguish a pristine, new analysis environment from a real environment that has been seen normal use.This project is assessing the potential for a new class of environment-aware malware that exploits usage-related artifacts that inevitably occur on real systems as a result of normal use, and which are absent in existing malware analysis environments. The project is first investigating techniques for recognizing artifacts related to past user activity and studying how malware might query or probe to acquire such information. Second, the researchers are evaluating the effectiveness of these techniques against current dynamic malware analysis systems and how such defense systems might detect that queries or probes of environmental information indicate the presence of malware. Finally, the project is studying whether artificially created "wear and tear" artifacts might be injected into analysis environments to counter next-generation, environment-aware malware.