Alkanet[1, 2] Alkanet CPU CPU 2 Alkanet Alkanet (VMM) VMM Alkanet Windows Alkanet 1 Alkanet VMM BitVisor[3] BitVisor OS ユーザモード カーネルモード マルウェア観測用 PC VM

Similar documents
1 BitVisor [3] Alkanet[1] Alkanet (DLL) DLL 2 Alkanet Alkanet Alkanet VMM VMM Alkanet Windows [2] マルウェア 観 測 用 VM SystemCall Windows System

Computer Security Symposium October ,a) API API API Alkanet IDA MWS API Proposal of static analysis assistance method utilizi

今週の進捗

( 億 種 ) マルウェアが 急 速 に 増 加! 短 時 間 で 解 析 し, マルウェアの 意 図 や 概 略 を 把 握 したい マルウェアを 実 行 し, 挙 動 を 観 測 することで 解 析 する 動 的 解 析 が 有 効 しかし, マルウェアの 巧 妙 化 により, 観 測 自 体

29 jjencode JavaScript

Web Web Web Web Web, i

258 5) GPS 1 GPS 6) GPS DP 7) 8) 10) GPS GPS ) GPS Global Positioning System

MAC root Linux 1 OS Linux 2.6 Linux Security Modules LSM [1] Security-Enhanced Linux SELinux [2] AppArmor[3] OS OS OS LSM LSM Performance Monitor LSMP

GPGPU

2 [2] Flow Visualizer 1 DbD 2. DbD [4] Web (PV) Web Web Web 3 ( 1) ( 1 ) Web ( 2 ) Web Web ( 3 ) Web DbD DbD () DbD DbD DbD 2.1 DbD DbD URL URL Google

1 3DCG [2] 3DCG CG 3DCG [3] 3DCG 3 3 API 2 3DCG 3 (1) Saito [4] (a) 1920x1080 (b) 1280x720 (c) 640x360 (d) 320x G-Buffer Decaudin[5] G-Buffer D

indd

VMware VirtualCenter: Virtual Infrastructure Management Software

21 e-learning Development of Real-time Learner Detection System for e-learning

ActionScript Flash Player 8 ActionScript3.0 ActionScript Flash Video ActionScript.swf swf FlashPlayer AVM(Actionscript Virtual Machine) Windows

23 Fig. 2: hwmodulev2 3. Reconfigurable HPC 3.1 hw/sw hw/sw hw/sw FPGA PC FPGA PC FPGA HPC FPGA FPGA hw/sw hw/sw hw- Module FPGA hwmodule hw/sw FPGA h

第6期末セミナー2006-1rev1.ppt

大月勇人, 若林大晃, 瀧本栄二, 齋藤彰一, 毛利公一 立命館大学 名古屋工業大学

fiš„v5.dvi

2). 3) 4) 1.2 NICTNICT DCRA Dihedral Corner Reflector micro-arraysdcra DCRA DCRA DCRA 3D DCRA PC USB PC PC ON / OFF Velleman K8055 K8055 K8055

28 Docker Design and Implementation of Program Evaluation System Using Docker Virtualized Environment

IPSJ SIG Technical Report Vol.2009-DPS-141 No.20 Vol.2009-GN-73 No.20 Vol.2009-EIP-46 No /11/27 1. MIERUKEN 1 2 MIERUKEN MIERUKEN MIERUKEN: Spe

& Vol.2 No (Mar. 2012) 1,a) , Bluetooth A Health Management Service by Cell Phones and Its Us

[2] 2. [3 5] 3D [6 8] Morishima [9] N n 24 24FPS k k = 1, 2,..., N i i = 1, 2,..., n Algorithm 1 N io user-specified number of inbetween omis

( ) [1] [4] ( ) 2. [5] [6] Piano Tutor[7] [1], [2], [8], [9] Radiobaton[10] Two Finger Piano[11] Coloring-in Piano[12] ism[13] MIDI MIDI 1 Fig. 1 Syst

THE INSTITUTE OF ELECTRONICS, INFORMATION AND COMMUNICATION ENGINEERS TECHNICAL REPORT OF IEICE.

1 Web [2] Web [3] [4] [5], [6] [7] [8] S.W. [9] 3. MeetingShelf Web MeetingShelf MeetingShelf (1) (2) (3) (4) (5) Web MeetingShelf

第６２巻　第１号　平成２４年４月／石こうを用いた木材ペレット

17 Proposal of an Algorithm of Image Extraction and Research on Improvement of a Man-machine Interface of Food Intake Measuring System

2) TA Hercules CAA 5 [6], [7] CAA BOSS [8] 2. C II C. ( 1 ) C. ( 2 ). ( 3 ) 100. ( 4 ) () HTML NFS Hercules ( )

SmartLMSユーザーズガイド＜講師編＞

1 Fig. 1 Extraction of motion,.,,, 4,,, 3., 1, 2. 2.,. CHLAC,. 2.1,. (256 ).,., CHLAC. CHLAC, HLAC. 2.3 (HLAC ) r,.,. HLAC. N. 2 HLAC Fig. 2

,,,,., C Java,,.,,.,., ,,.,, i

IPSJ SIG Technical Report Vol.2011-IOT-12 No /3/ , 6 Construction and Operation of Large Scale Web Contents Distribution Platfo

& Vol.5 No (Oct. 2015) TV 1,2,a) , Augmented TV TV AR Augmented Reality 3DCG TV Estimation of TV Screen Position and Ro

fiš„v8.dvi

,,.,,., II,,,.,,.,.,,,.,,,.,, II i

特-3.indd

Input image Initialize variables Loop for period of oscillation Update height map Make shade image Change property of image Output image Change time L

Firefox Firefox Mozilla addons.mozilla.org (AMO) AMO Firefox Mozilla AMO Firefox Firefox Mozilla Firefox Firefox Firefox 年間登録数

IPSJ SIG Technical Report Vol.2012-MUS-96 No /8/10 MIDI Modeling Performance Indeterminacies for Polyphonic Midi Score Following and

Fig. 3 Flow diagram of image processing. Black rectangle in the photo indicates the processing area (128 x 32 pixels).

(a) 1 (b) 3. Gilbert Pernicka[2] Treibitz Schechner[3] Narasimhan [4] Kim [5] Nayar [6] [7][8][9] 2. X X X [10] [11] L L t L s L = L t + L s

394-04

6 2. AUTOSAR 2.1 AUTOSAR AUTOSAR ECU OSEK/VDX 3) OSEK/VDX OS AUTOSAR AUTOSAR ECU AUTOSAR 1 AUTOSAR BSW (Basic Software) (Runtime Environment) Applicat

IPSJ SIG Technical Report Vol.2012-CG-148 No /8/29 3DCG 1,a) On rigid body animation taking into account the 3D computer graphics came


NW-E062 / E063 / E062K/ E063K

Zinstall WinWin 日本語ユーザーズガイド

16_.....E...._.I.v2006

2. CABAC CABAC CABAC 1 1 CABAC Figure 1 Overview of CABAC 2 DCT 2 0/ /1 CABAC [3] 3. 2 値化部 コンテキスト計算部 2 値算術符号化部 CABAC CABAC

JOURNAL OF THE JAPANESE ASSOCIATION FOR PETROLEUM TECHNOLOGY VOL. 66, NO. 6 (Nov., 2001) (Received August 10, 2001; accepted November 9, 2001) Alterna

IPSJ SIG Technical Report Vol.2016-CE-137 No /12/ e β /α α β β / α A judgment method of difficulty of task for a learner using simple

IPSJ SIG Technical Report Vol.2014-EIP-63 No /2/21 1,a) Wi-Fi Probe Request MAC MAC Probe Request MAC A dynamic ads control based on tra

ファイルベースのサンドボックスの回避

26 FPGA FPGA (Field Programmable Gate Array) ASIC (Application Specific Integrated Circuit) FPGA FPGA FPGA FPGA Linux FreeDOS skewed way L1

bitvisor_summit.pptx

82801pdf.pqxp

[2] OCR [3], [4] [5] [6] [4], [7] [8], [9] 1 [10] Fig. 1 Current arrangement and size of ruby. 2 Fig. 2 Typography combined with printing

Transcription:

Computer Security Symposium 2014 22-24 October 2014 525-8577 1-1-1 yotuki@asl.cs.ritsumei.ac.jp, {takimoto, mouri}@cs.ritsumei.ac.jp 466-8555 shoichi@nitech.ac.jp Alkanet CPU Identifying of System Call Invoker by Branch Trace Facilities Yuto Otsuki Eiji Takimoto Shoichi Saito Koichi Mouri Ritsumeikan University 1-1-1 Nojihigashi, Kusatsu, Shiga 525-8577 Japan yotuki@asl.cs.ritsumei.ac.jp, {takimoto, mouri}@cs.ritsumei.ac.jp Nagoya Institute of Technology Gokiso-cho, Showa-ku, Nagoya, Aichi, 466-8555 Japan shoichi@nitech.ac.jp Abstract Recent malware infects other processes. Another one consists of two or more modules and plugins. It is difficult to trace these malware because traditional methods focus on threads or processes. We are developing Alkanet, a system call tracer for malware analysis. To trace the malware, Alkanet identifies the system call invoker by stack trace. However, if malware has falsified its stack, Alkanet cannot identify it correctly. In this paper, we describe a method for identifying a system call invoker by branch trace facilities. We consider the effectiveness of branch trace facilities for malware analysis. 1-843 -

Alkanet[1, 2] Alkanet CPU CPU 2 Alkanet Alkanet (VMM) VMM Alkanet Windows Alkanet 1 Alkanet VMM BitVisor[3] BitVisor OS ユーザモード カーネルモード マルウェア観測用 PC VM システムコール Windows システムコールアナライザログ Alkanet BitVisor IEEE1394 1: Alkanet ロギング用 PC ログ解析ツール ログ解析 挙動抽出 保存 ロガー VMM Intel CPU Intel VT (Intel Virtualization Technology) Windows OS 32bit Windows XP Service Pack 3 sysenter sysexit Alkanet PC IEEE 1394 [2] VAD (Virtual Address Descriptor) PTE (Page Table Entry) 3 BTS Intel CPU MSR (Model Specific Register) - 844 -

LBR (Last Branch Record) BTS (Branch Trace Store) BTF (Single Step on Branches) 2 BTS BTS BTS 3 CPU IA32 DS AREA MSR BTS IA32 DEBUGCTL MSR TR bit ( 6bit) BTS bit ( 7bit) BTS OFF OS bit ( 9bit) BTS OFF USR bit ( 10bit) BTINT bit ( 8bit) BTINT bit 4 BTS VMM Alkanet BTS VM 4.1 VM OS VM MSR Alkanet VM MSR VM IA32 DEBUGCTL VMCS (Virtual-Machine Control Structures) IA32 DS AREA VMCS MSR IA32 DS AREA OS OS Windows Alkanet BTS Windows Windows Mm- PfnDatabase BTS OS BTS OFF OS bit 4.2 BTS Alkanet BTS Windows Windows PCR (Processor Control Region) - 845 -

4.3 call BTS call call ret 5 5.1 DLL [2] rundll32.exe DLL rundll32.exe BTS MWS Datasets 2014 [4] CCC DATAset 2013 DLL Conficker.dll 2 Stack- Trace 1 2 [] API [2] BTS From Valid From BTS Valid VALID INVALID BTINT UNVALIDATED 2 [11] [10] rundll32.exe Load- LibraryW Conficker.dll [05] [00] Conficker.dll Sleep API SleepEx API NtDelayExecution NtDelayExecution [05] [00] BTS (VALID) [11] [10] (UNVALIDATED) BTINT BTS 5.2 PDF call ROP (Return Oriented Programming) - 846 -

StackTrace:! SP: 7ed24, StackBase: 80000, StackLimit: 74000! [00] <- 7c94d1fc (API: NtDelayExecution+0xc, Writable: 0, Dirty: 0,! VAD: {7c940000--7c9dc000, ImageMap: 1, File: "\WINDOWS\system32\ntdll.dll"}),! From: 7c94d1fa, Valid: VALID, SP: 7ed24! [01] <- 7c8023f1 (API: SleepEx+0x51, Writable: 0, Dirty: 0,! From: 7c8023eb, Valid: VALID, SP: 7ed28! [02] <- 7c802455 (API: Sleep+0xf, Writable: 0, Dirty: 0,! From: 7c802450, Valid: VALID, BP: 7ed7c! [03] <- 10003898 (API: -, Writable: 0, Dirty: 0,! VAD: {10000000--10018000, ImageMap: 1, File: "\Conficker.dll"}),! From: 10003892, Valid: VALID, BP: 7ed8c! [04] <- 1000401b (API: -, Writable: 0, Dirty: 0,! VAD: {10000000--10018000, ImageMap: 1, File: "\Conficker.dll"}),! From: 10004016, Valid: VALID, BP: 7f184! [05] <- 7c94118a (API: LdrpCallInitRoutine+0x14, Writable: 0, Dirty: 0,! VAD: {7c940000--7c9dc000, ImageMap: 1, File: "\WINDOWS\system32\ntdll.dll"}),! From: 7c941187, Valid: VALID, BP: 7f1a4! < 省略 >! [10] <- 7c80aeec (API: LoadLibraryW+0x11, Writable: 0, Dirty: 0,! From: -, Valid: UNVALIDATED, BP: 7f888! [11] <- 1001792 (API: -, Writable: 0, Dirty: 0,! VAD: {1000000--100b000, ImageMap: 1, File: "\WINDOWS\system32\rundll32.exe"}),! From: -, Valid: UNVALIDATED, BP: 7f89c! < 省略 >! 2: Conficker.dll call ret call ret BTS MWS Datasets 2014 [4] D3M 2013 PDF [2] PDF 3 3 (Writable: 1) (Dirty: 1) ([03]) Virtual- Protect API VirtualProtectEx API NtProtect- VirtualMemory ([02] [00]) NtProtectVirtualMemory [02] [00] Valid: VALID BTS [03] From 2f900a9 2f900c7 INVALID BTS 3 [03] 4 BTS (from) (to) 4 2f900a9 2f900ae call ( 1 ) 2f900c5 Virtual- Protect API 7c801ad9 jmp ( 2 ) - 847 -

Stacktrace:! SP: f601ff8, StackBase: 130000, StackLimit: 11d000! [00] <- 7c94d6dc (API: NtProtectVirtualMemory+0xc, Writable: 0, Dirty: 0,! VAD: {7c940000--7c9dc000, ImageMap: 1, File: "\WINDOWS\system32\ntdll.dll"}),! From: 7c94d6da, Valid: VALID, SP: f601ff8! [01] <- 7c801a81 (API: VirtualProtectEx+0x20, Writable: 0, Dirty: 0,! From: 7c801a7f, Valid: VALID, SP: f601ffc! [02] <- 7c801aec (API: VirtualProtect+0x18, Writable: 0, Dirty: 0,! From: 7c801ae7, Valid: VALID, BP: f60201c! [03] <- 2f900c7 (API: -, Writable: 1, Dirty: 1,! VAD: {2f90000--2f91000, ImageMap: 0}),! From: 2f900a9, Valid: INVALID, BP: f602038! 3: PDF from= 2f900a9, to= 2f900ae call 2f900ae! from= 2f900c5, to=7c801ad9 jmp EBX! 4: 2 jmp API API jmp call 2f900c5 call ret 4 BTS 6 BTS Intel Core 2 Quad Q6600 2.4GHz 4GB PC PCMark05[5] System Test Suite PC Windows Native Alkanet (Normal) Alkanet (ST) BTS Alkanet (BTS) 3 Alkanet OS Windows Native Alkanet (Normal) Alkanet (ST) ( PCMarks) 5557 4171 3266 Native 100 Alkanet (Normal) 75 Alkanet (ST) 59 Alkanet (BTS) Web Page Rendering Internet Explorer Alkanet (BTS) HDD Native 10% BTS 1. 2. 2 call ret - 848 -

1 IA32 DS AREA PTE QEMU HDD Native 10% QEMU 7 kbouncer[6] API 1 LBR ROP BTS kbouncer Windows VMM VM BTS CXPInspector[7] VMM DLL CXPInspector LBR BTS 8 8.1 BTS 5.2 call ret call call ret BTS API Windows DLL BTS 8.2 BTS 6 kbouncer[6] % LBR BTS LBR Haswell CPU EN CALLSTACK LBR BTS EN CALLSTACK LBR MSR 16-849 -

8.3 BTS BTS LBR BTS 9 BTS BTS call ret BTS LBR EN CALLSTACK [1] Otsuki, Y., Takimoto, E., Kashiyama, T., Saito, S., Cooper, E. and Mouri, K.: Tracing Malicious Injected Threads Using Alkanet Malware Analyzer, IAENG Transactions on Engineering Technologies, Lecture Notes in Electrical Engineering, Vol. 247, Springer Netherlands, pp. 283 299 (2014). [2] Alkanet 2013 Vol. 2013, No. 4, pp. 753 760 (2013). [3] Shinagawa, T., Eiraku, H., Tanimoto, K., Omote, K., Hasegawa, S., Horie, T., Hirano, M., Kourai, K., Oyama, Y., Kawai, E., Kono, K., Chiba, S., Shinjo, Y. and Kato, K.: Bit- Visor: a thin hypervisor for enforcing i/o device security, Proceedings of the 2009 ACM SIGPLAN/SIGOPS international conference on Virtual execution environments, ACM, pp. 121 130 (2009). [4] MWS Datasets 2014 CSEC Vol. 2014-CSEC- 66, No. 19, pp. 1 7 (2014). [5] Futuremark Corporation: Futuremark - Legacy Benchmarks, http://www.futuremark. com/benchmarks/legacy (2014, accessed 2014-08-25). [6] Pappas, V., Polychronakis, M. and Keromytis, A. D.: Transparent ROP Exploit Mitigation Using Indirect Branch Tracing, Proceedings of the 22nd USENIX Conference on Security, SEC 13, USENIX Association, pp. 447 462 (2013). [7] Willems, C., Hund, R. and Holz, T.: Hypervisor-based, hardware-assisted system monitoring, Virus Bulletin Conference (2013). - 850 -

2026 © docsplayer.net プライバシー | 利用規約 | フィードバック