Advertisement

A System for Analyzing Advance Bot Behavior

  • JooHyung Oh
  • Chaetae Im
  • HyunCheol Jeong
Part of the Communications in Computer and Information Science book series (CCIS, volume 54)

Abstract

Bot behavior analysis is an essencial component in botnet detection and response. Recent reseach on bot behavior analysis is focus on idenyifing wheather analysis target file is bot or not by monitoring user-level API call information of bot process and discover their malicous behaviors. However, such research does not monitor the bot process which has kernel-rootkit, anti-VM and static-DLL/binary code injection capabilities. In this paper, we present an approach based on a combination of System Call Layer rebuilding and process executing that enables automatic thwarting static-DLL/binary code injection. Also, we have built a system for analyzing advance bot behavior that can monitor the behavior of bot process at kernel-level and thwart some anti-vm methods. For experiments and evaluation, we have conduct experiments on several recent bot samples which have kernl-rootkit, anti-VM and static-DLL/binary code injection capabilities and shown that our system can successfully extrat their API call information and malicious behaviors from them.

Keywords

Botnet Bot Malware Behavior Analysis 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    World Economic Forum, The internet is doomed, BBC News (January 2007)Google Scholar
  2. 2.
  3. 3.
  4. 4.
  5. 5.
    Dinaburg, A., Royal, P., Sharif, M., Lee, W.: Ether: Malware Analysis via Hardware Virtualization Extensions. In: CCS 2008 (November 2008)Google Scholar
  6. 6.
    Yin, H., Liang, Z., Song, D.: HookFinder: Identifying and Understanding Malware Hooking Behaviors. In: NDSS 2008 (February 2008)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • JooHyung Oh
    • 1
  • Chaetae Im
    • 1
  • HyunCheol Jeong
    • 1
  1. 1.Korea Internet and Security AgencySeoulKorea

Personalised recommendations