Sandboxing and reasoning on malware infection trees

Krishnendu Ghosh; Jose Andre Morales; William Casey; Bud Mishra

doi:10.1109/MALWARE.2015.7413686

Sandboxing and reasoning on malware infection trees

Krishnendu Ghosh, Jose Andre Morales, William Casey, Bud Mishra

Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Malware infection trees are computational structures for analyzing and identifying different processes and files during the execution of malware. In this paper, we describe a sandboxing-based formalization to predict malware behaviors such as the possibility of file and process creation. Model checking is used as a querying mechanism on a labeled transition system representing a malware infection tree. We evaluate computational feasibility of our formalism using a case study on Backdoor.WIN32.Poison malware and behavior specified by malware infection trees.

Original language	English (US)
Title of host publication	2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	69-73
Number of pages	5
ISBN (Electronic)	9781509003174
DOIs	https://doi.org/10.1109/MALWARE.2015.7413686
State	Published - Feb 18 2016
Event	10th International Conference on Malicious and Unwanted Software, MALWARE 2015 - Fajardo, United States Duration: Oct 20 2015 → Oct 22 2015

Publication series

Name	2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015

Other

Other	10th International Conference on Malicious and Unwanted Software, MALWARE 2015
Country/Territory	United States
City	Fajardo
Period	10/20/15 → 10/22/15

Keywords

Cognition
Computational modeling
Malware
Markov processes
Model checking
Probabilistic logic

ASJC Scopus subject areas

Computer Networks and Communications
Software
Safety, Risk, Reliability and Quality

Access to Document

10.1109/MALWARE.2015.7413686

Cite this

Ghosh, K., Morales, J. A., Casey, W., & Mishra, B. (2016). Sandboxing and reasoning on malware infection trees. In 2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015 (pp. 69-73). Article 7413686 (2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/MALWARE.2015.7413686

Sandboxing and reasoning on malware infection trees. / Ghosh, Krishnendu; Morales, Jose Andre; Casey, William et al.
2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015. Institute of Electrical and Electronics Engineers Inc., 2016. p. 69-73 7413686 (2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Ghosh, K, Morales, JA, Casey, W & Mishra, B 2016, Sandboxing and reasoning on malware infection trees. in 2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015., 7413686, 2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015, Institute of Electrical and Electronics Engineers Inc., pp. 69-73, 10th International Conference on Malicious and Unwanted Software, MALWARE 2015, Fajardo, United States, 10/20/15. https://doi.org/10.1109/MALWARE.2015.7413686

Ghosh K, Morales JA, Casey W, Mishra B. Sandboxing and reasoning on malware infection trees. In 2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015. Institute of Electrical and Electronics Engineers Inc. 2016. p. 69-73. 7413686. (2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015). doi: 10.1109/MALWARE.2015.7413686

@inproceedings{b72f2485b65a47449f197ecf1be18160,

title = "Sandboxing and reasoning on malware infection trees",

abstract = "Malware infection trees are computational structures for analyzing and identifying different processes and files during the execution of malware. In this paper, we describe a sandboxing-based formalization to predict malware behaviors such as the possibility of file and process creation. Model checking is used as a querying mechanism on a labeled transition system representing a malware infection tree. We evaluate computational feasibility of our formalism using a case study on Backdoor.WIN32.Poison malware and behavior specified by malware infection trees.",

keywords = "Cognition, Computational modeling, Malware, Markov processes, Model checking, Probabilistic logic",

author = "Krishnendu Ghosh and Morales, {Jose Andre} and William Casey and Bud Mishra",

year = "2016",

month = feb,

day = "18",

doi = "10.1109/MALWARE.2015.7413686",

language = "English (US)",

series = "2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "69--73",

booktitle = "2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015",

note = "10th International Conference on Malicious and Unwanted Software, MALWARE 2015 ; Conference date: 20-10-2015 Through 22-10-2015",

}

TY - GEN

T1 - Sandboxing and reasoning on malware infection trees

AU - Ghosh, Krishnendu

AU - Morales, Jose Andre

AU - Casey, William

AU - Mishra, Bud

PY - 2016/2/18

Y1 - 2016/2/18

N2 - Malware infection trees are computational structures for analyzing and identifying different processes and files during the execution of malware. In this paper, we describe a sandboxing-based formalization to predict malware behaviors such as the possibility of file and process creation. Model checking is used as a querying mechanism on a labeled transition system representing a malware infection tree. We evaluate computational feasibility of our formalism using a case study on Backdoor.WIN32.Poison malware and behavior specified by malware infection trees.

AB - Malware infection trees are computational structures for analyzing and identifying different processes and files during the execution of malware. In this paper, we describe a sandboxing-based formalization to predict malware behaviors such as the possibility of file and process creation. Model checking is used as a querying mechanism on a labeled transition system representing a malware infection tree. We evaluate computational feasibility of our formalism using a case study on Backdoor.WIN32.Poison malware and behavior specified by malware infection trees.

KW - Cognition

KW - Computational modeling

KW - Malware

KW - Markov processes

KW - Model checking

KW - Probabilistic logic

UR - http://www.scopus.com/inward/record.url?scp=84969750040&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84969750040&partnerID=8YFLogxK

U2 - 10.1109/MALWARE.2015.7413686

DO - 10.1109/MALWARE.2015.7413686

M3 - Conference contribution

AN - SCOPUS:84969750040

T3 - 2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015

SP - 69

EP - 73

BT - 2015 10th International Conference on Malicious and Unwanted Software, MALWARE 2015

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 10th International Conference on Malicious and Unwanted Software, MALWARE 2015

Y2 - 20 October 2015 through 22 October 2015

ER -

Sandboxing and reasoning on malware infection trees

Abstract

Publication series

Other

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this