Malware AnalyNcs at SRI

Phillip Porras	
  

Computer Science Laboratory, SRI	
  InternaMonal

Date: Sprint	
  2012

NOT FOR	
  PUBLIC DISTRIBUTION
2011 Great	
  AnMmalware Papers in Academia	
  

hOp://mtc.sri.com/2011BestPapers.html

Tracking Internet Fraudsters

Click	
  Trajectories: End-­‐to-­‐End Analysis	
  of the Spam Value Chain

Levchenko et	
  al., IEEE Security Symposium 2011

Summary: Perhaps	
  the	
  most comprehensive	
  analysis	
  of	
  the	
  underground spam	
  economy to

date. Strong Evidence that SPAM	
  adverNsers are boPlenecked at a handful of banks

Understanding Fraudulent Ac?vi?es	
  in Online Ad Exchanges	
  

BreO Stone-­‐Gross, Ryan Stevens, Richard Kemmerer, Christopher Kruegel, Giovanni Vigna,	
  

Apostolis Zarras, ACM/SIGCOMM	
  Internet	
  Measurement	
  Conference 2011

Summary: First analysis of fraud in ad exchanges driven by botnets with data from inside an

ad network, how botnets are used to perpetrate ad-­‐fraud, and how they make money.

Measuring Pay-­‐per-­‐Install: The Commodi?za?on of Malware Distribu?on

Juan Caballero, Chris Grier, ChrisMan Kreibich,	
  Vern Paxson,	
  Usenix Security 2011

Summary: Another great measurement study of underground malware economy. Best

paper award	
  at Usenix Security!	
   PPI is	
  all about	
  the	
  economy that	
  drives	
  criminals	
  to infect	
  

vicNm	
  machines,	
  and how	
  they convert	
  those	
  installs	
  into cash.	
  12 of	
  the	
  top

installs employ	
  PPI.

20 malware	
  
2011 Great	
  AnMmalware Papers in Academia	
  

hOp://mtc.sri.com/2011BestPapers.html

DNS Abuse Monitoring

Monitoring the IniNal DNS Behavior of Malicious Domains, Shuang Hao,	
  Nick	
  Feamster,	
  

Ramakant Pandrangi ACM/SIGCOMM	
  Internet	
  Measurement	
  Conference 2011

Summary: InteresNng measurement	
  paper with	
  some important	
  insights	
  for rapid	
  

classificaNon of malicious domains. 55%	
  of of malware campaigns use domains registered w/

in 24hrs of campaign + plus key ASs where JIT malware domains are born.

DetecNng Malware Domains at the Upper DNS Hierararchy,	
  Manos Antonakakis, Roberto

Perdisci,	
  Wenke Lee, Nikolaos Vasiloglou II, David Dagon

Usenix Security 2011

Summary: Another malware DNS detecNon system, but from a unique global vantage point.

How to detect	
  malware DNS	
  acNvity	
  by monitoring	
  upper-­‐level	
  DNS	
  query	
  paPerns	
  (Kopis).

BOTNET DETECTION SYSTEMS

BOTMAGNIFIER: LocaNng	
  Spambots on the	
  Internet, Gianluca Stringhini, Thorsten Holz,	
  BreO

Stone-­‐Gross, Christopher Kruegelx, and Giovanni Vigna

Summary: One of the few	
  botnet	
  detecNon	
  systems	
  published	
  this year,	
  the other significant	
  

one being JACKSTRAW. Using maillogs to detect	
  hosts	
  w/ spam	
  behavioral paPerns

what match known spammers.
2011 Great	
  AnMmalware Papers in Academia	
  

MALWARE ANALYSIS SYSTEMS

BitShred: Feature Hashing Malware for Scalable Triage and SemanNc Analysis, Jiyong Jang,

David Brumley and Shobha Venkataraman, ACM	
  CCS 2011

Summary: A new approach to the malware classificaNon problem with impressive scalability

and performance.	
  

The Power of ProcrasNnaNon: DetecNon and MiNgaNon of ExecuNon-­‐Stalling Malicious Code,

Clemens	
  Kolbitsch,	
  Engin Kirda, Christopher Kruegel, ACM	
  CCS 2011

Summary: An important step in improving the state of dynamic analysis.

Virtuoso: Narrowing the SemanNc Gap in Virtual Machine IntrospecNon, Brendan Dolan-­‐GaviO,	
  

Tim Leek, Michael Zhivich, Jonathon Giffin, and Wenke Lee, IEEE Security Symposium 2011

Summary: IntrospecNon	
  has featured	
  prominently	
  in many	
  recent	
  security	
  soluNons,	
  such	
  as

virtual machine-­‐based intrusion detecNon,	
  forensic	
  memory analysis,	
  and low-­‐arNfact	
  

malware	
  analysis.	
   This system	
  shows lots of	
  promise	
  and will hopefully inspire	
  a new	
  suite	
  of	
  

introspecNon	
  systems.

A Study of Android ApplicaNon Security, William Enck, Damien Octeau, Patrick McDaniel, and

Swarat Chaudhuri,	
  Usenix Security 2011

Summary: An interesNng tool that would likely be useful for next-­‐generaNon Android

malware	
  analysis systems.	
  
Malware Binary Reverse Engineering BotHunter

malgram.mtc.sri.com www.bothunter.net

What’s	
  Novel Here è BotHunter

Automated Malware Reverse Engineering • Flip the IDS Paradigm -­‐ INFECTION • Binary Structural Analysis DIAGNOSIS not	
  INBOUND EXPLOIT ALARMS • Dynamic Analyses • Network Dialog CorrelaMon (patent	
   • API	
  Hooking pending)	
   • Peer App Kernel Probing	
   • Analyze two-­‐way	
  communicaNon flows

• VM	
  IntrospecMon between internal assets and the Internet	
  

• Analyze all dialog exchanges against	
  

• StaMc Program Analysis defined	
   malware infec?on lifecycle model	
  

• Unpacking

• Code DeobfuscaMon Next	
  Steps:	
   IntegraNng	
  InfecNon	
  Diagnosis	
  with

• DecompilaMon Binary object intercepNon |=	
   InfecNon

• Program Analysis

• Program RewriMng

ValidaNon
Malware Threat Tracking

hPp://Nnyurl/InfectedUSA

SRI	
  does mulMple forms of malware Threat	
  

Intel Tracking

• Honeynets

• ReflectorNets

• IP ReputaMon Service

• CALO – Web Tracking and InterpretaMon

• Free Sensors	
  

SRI Threat ReputaNon Service:

OpenFlow

Security	
  Through	
  

So?ware Defined Networking

www.openflowsec.org	
  

Fresco / FortNOX

PublicaMons

Current	
  Video Demos

Automated Malware QuaranMne

Reflector Nets

Stopping Illegal VTunnels

hOp://kb.bothunter.net/ipInfo/IPRep.php?IP=%s&FORMAT=csv

-­‐ the FORMAT arg can be CSV, TEXT, TAB, XML
hOp://www.bothunter.net	
  

Wired

Magazine

12/30/2012