Run-Time Malware Analysis System

[Nytro]

RMAS

(Run-Time Malware Analysis System)

A Framework for Malware Analysis and Malware Detection

Sommario
Introduction ....................................................................................................................................................... 3
Architecture ....................................................................................................................................................... 3
Static Analysis .................................................................................................................................................... 4
Static Analysis Conclusion ............................................................................................................................ 5
Dynamic Analysis ............................................................................................................................................... 5
Dynamic Malware Detection Module ........................................................................................................... 9
Dynamic Analysis Conclusion .................................................................................................................... 10
Case Study ....................................................................................................................................................... 11
Scenario 1 .................................................................................................................................................... 11
Scenario 2 .................................................................................................................................................... 11
Scenario 3 .................................................................................................................................................... 11
Future Work..................................................................................................................................................... 12
Conclusion ....................................................................................................................................................... 12
Bibliography ..................................................................................................................................................... 13

Introduction

The malware is a threat for our systems because it can hit and retrieve our confidential information by using different attacking vectors. The security of modern computer systems depends on the ability by the users to keep software, OSes and antivirus products up-to-date.

Since new viruses or new viral strains are released every day, the antivirus vendors have to update their software and their signatures and then distribute them. Conventional anti-malware programs rely on “static signature” to detect malware, but malware writers improve their codes to make them undetectable and stay one step ahead of static-signature-based detection.

The Dynamic Malware Detection Systems are not new concepts, but my project is based on the development and the implementation of a system, called RMAS (Run-Time Malware Analysis System) in order to allow analysts to make dynamic analysis of new malware, to understand the malware behavior and produce a graphical dangerousness level of the analyzed program, by using just one modular tool.

RMAS has been developed also because sometimes there are malware samples that the company has to analyze within the organization perimeter for privacy or policy reasons, to prevent leakage of confidential data.

For example, malware samples could be gathered from sources such as honeypots of a specific network or from investigations and lots of these software cannot be analyzed from external analysis software, this is the main reason why I developed RMAS.

The system has also been developed in order to realize an automated analysis thus limiting human intervention.

Download:

http://www.kaspersky.com/images/sponchioni,_roberto_-_rmas_a_framework_for_malware_analysis_and_malware_detection-10-98486.pdf