A System for Analyzing Advance Bot Behavior
Bot behavior analysis is an essencial component in botnet detection and response. Recent reseach on bot behavior analysis is focus on idenyifing wheather analysis target file is bot or not by monitoring user-level API call information of bot process and discover their malicous behaviors. However, such research does not monitor the bot process which has kernel-rootkit, anti-VM and static-DLL/binary code injection capabilities. In this paper, we present an approach based on a combination of System Call Layer rebuilding and process executing that enables automatic thwarting static-DLL/binary code injection. Also, we have built a system for analyzing advance bot behavior that can monitor the behavior of bot process at kernel-level and thwart some anti-vm methods. For experiments and evaluation, we have conduct experiments on several recent bot samples which have kernl-rootkit, anti-VM and static-DLL/binary code injection capabilities and shown that our system can successfully extrat their API call information and malicious behaviors from them.
KeywordsBotnet Bot Malware Behavior Analysis
Unable to display preview. Download preview PDF.
- 1.World Economic Forum, The internet is doomed, BBC News (January 2007)Google Scholar
- 2.CWSandbox, http://www.cwsandbox.org
- 3.TTAnalyze, http://iseclab.org/projects/ttanalyze/
- 5.Dinaburg, A., Royal, P., Sharif, M., Lee, W.: Ether: Malware Analysis via Hardware Virtualization Extensions. In: CCS 2008 (November 2008)Google Scholar
- 6.Yin, H., Liang, Z., Song, D.: HookFinder: Identifying and Understanding Malware Hooking Behaviors. In: NDSS 2008 (February 2008)Google Scholar