System Call API Obfuscation (Extended Abstract).
ABSTRACT We claim that attacks can evade the comprehension of security tools that rely on knowledge of standard system call interfaces
to reason about process execution behavior. Our attack, called Illusion, will invoke privileged operations in a Windows or Linux kernel at the request of user-level processes without requiring
those processes to call the actual system calls corresponding to the operations. The Illusion interface will hide system operations
from user-, kernel-, and hypervisor-level monitors mediating the conventional system-call interface. Illusion will alter neither
static kernel code nor read-only dispatch tables, remaining elusive from tools protecting kernel memory.
- [Show abstract] [Hide abstract]
ABSTRACT: Malware obfuscation obscures malware into a different form that's functionally identical to the original one, and makes syntactic signature ineffective. Furthermore, malware samples are huge and growing at an exponential pace. Behavioral signature is an effective way to defeat obfuscation. However, state-of-the-art behavioral signature, behavior graph, is although very effective but unfortunately too complicated and not scalable to handle exponential growing malware samples; in addition, it is too slow to be used as real-time detectors. This paper proposes an anti-obfuscation and scalable behavioral signature generation system, DiffSig, which voids information-flow tracking which is the chief culprit for the complex and inefficiency of graph behavior, thus, losing some data dependencies, but describes handle dependencies more accurate than graph behavior by restrict the profile type of resource that each handle dependency can reference to. Our experiment results show that DiffSig is scalable and efficient, and can detect new malware samples effectively.Proceedings of the 2013 international conference on Information and Communication Technology; 03/2013