# JITScanner: Just-in-Time Executable Page Check in the Linux Operating System +
## 4 Assessment
### Effectiveness  
Our effectiveness testing focuses on two primary objectives:  
1. Measuring the \"signature flexibility\" of JITScanner, which is the extent to which signatures from plain malware remain effective for a variant in the same family;
2. Measuring the \"signature retention\" of JITScanner, which is the extent to which signatures from plain malware remain effective for their packed counterparts. For the malware dataset, we selected the \"VirusShare_ELF_20200405\", which is the latest dataset provided by the free malware sharing website VirusShare, comprising approximately 40,000 samples [26]. To showcase the effectiveness of JITScanner, and of a representative tool we used as competitor, namely ClamAV [14], we executed the samples both in their original state and after packing them with a simple packer sourced online [27]. From the original 40,000, we picked 1930 samples that where compatible with our chosen packer and scanned them with ClamAV. Out of these, we extracted 466 samples which ClamAV associated with an immediately identifiable malware family; these are reported in Table 2. After this, we run all samples, both in plain and in packed form, under JITScanner and logged the pages whose accesses in write-execute and/or execute mode have been intercepted (all the datasets exploited in this study have been made available at: [[https://github.com/Capo80/Malware_Datasets](https://github.com/Capo80/Malware_Datasets)]([https://github.com/Capo80/Malware_Datasets](https://github.com/Capo80/Malware_Datasets)) (accessed on 20 February 2024)). For the logged pages with samples associated with a family, we chose the most common signature, ensuring that it did not yield any false positives during normal operations in our test. For the selection of such most common signature, we took from each logged page a sequence of bytes of code of length sufficient to identify actual machine instructions that typically appear after the prologue (e.g., classical push instructions at the beginning of a function) of the block of code where the thread jumped for fetching instructions into the page. For the different families of malware we analyzed, the length of this sequence of bytes was between 15 and 20. The most common signature of each family has been added to the Yara rules database. In particular, we added these signatures to the user agent of JITScanner, deployed it, and reanalyzed all samples on our automated malware testing facility, namely PHOENIX [28]. For this effectiveness test, the met \begin{table}
\begin{tabular}{c c c} \hline \hline
**Family Name** & **Malware Type** & **Number of Samples** \\ \hline Emotet & Trojan & 2 \\ Mirai & Botnet & 52 \\ Tsunami & Botnet & 71 \\ Gafgyt & Trojan & 320 \\ XMRIG Miner & Coin-miner & 21 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Families of the samples used. check on the executable page carried out at kernel level did not identify malware. Hence, malware identification is essentially carried out by the user-level agent. To assess point 1, we decided to select the most common signature for each family, which we identified through our log of extracted pages. Subsequently, we compared the efficacy of these signatures against the most common signature detected by ClamAV. The results are presented in Table 3. As we can see, JITScanner has a comparable or superior effectiveness across all analyzed families, with the exception of Gafgyt. This discrepancy is likely attributable to the limited number of pages per sample captured in our logs for Gafgyt--the average is 4--which is significantly lower compared to other families; this prevented us from finding an effective signature. We believe that this type of malware detects that it is running on a testing environment (e.g., because of the detection of a reduced number of CPUs) and gives rise to a rapid termination.