Behavior Nets: Context-Aware Behavior Modeling for Code Injection-Based Windows Malware

作     者：Jerre Starink Marieke Huisman Andreas Peter Andrea Continella 

作者机构：Semantics Cybersecurity & Services University Twente Faculty EEMCS Enschede Netherlands Formal Methods and Tools University Twente Faculty EEMCS Enschede Netherlands Departement of Computer Science Carl von Ossietzky Universität Oldenburg Oldenburg Germany 

出 版 物：《ACM Transactions on Privacy and Security》 

年 卷 期：1000年

主　　题：Malware Software Analysis Malicious Behaviors Code Injection 

摘      要：Despite significant effort put into research and development of defense mechanisms, new malware is continuously developed rapidly, making it still one of the major threats on the Internet. For malware to be successful, it is in the developer’s best interest to evade detection as long as possible. One method in achieving this is using Code Injection, where malicious code is injected into another benign process, making it do something it was not intended to *** detection and characterization of Code Injection is difficult. Many injection techniques depend solely on system calls that in isolation look benign and can easily be confused with other background system activity. There is therefore a need for models that can consider the context in which a single system event resides, such that relevant activity can be distinguished *** previous work, we conducted the first systematic study on code injection to gain more insights into the different techniques available to malware developers on the Windows platform. This paper extends this work by introducing and formalizing Behavior Nets: A novel, reusable, context-aware modeling language that expresses malicious software behavior in observable events and their general interdependence. This allows for matching on system calls, even if those system calls are typically used in a benign context. We evaluate Behavior Nets and experimentally confirm that introducing event context into behavioral signatures yields better results in characterizing malicious behavior than state-of-the-art. We conclude with valuable insights on how future malware research based on dynamic analysis should be conducted.