Abstract
Many threats that plague today's networks (e.g., phishing, botnets, denial of service attacks) are enabled by a complex ecosystem of attack programs commonly called malware. To combat these threats, defenders of these networks have turned to the collection, analysis, and reverse engineering of malware as mechanisms to understand these programs, generate signatures, and facilitate cleanup of infected hosts. Recently however, new malware instances have emerged with the capability to check and often thwart these defensive activities - essentially leaving defenders blind to their activities. To combat this emerging threat, we have undertaken a robust analysis of current malware and developed a detailed taxonomy of malware defender fingerprinting methods. We demonstrate the utility of this taxonomy by using it to characterize the prevalence of these avoidance methods, to generate a novel fingerprinting method that can assist malware propagation, and to create an effective new technique to protect production systems.
Original language | English (US) |
---|---|
Pages | 177-186 |
Number of pages | 10 |
DOIs | |
State | Published - 2008 |
Externally published | Yes |
Event | 2008 International Conference on Dependable Systems and Networks, DSN-2008 - Anchorage, AK, United States Duration: Jun 24 2008 → Jun 27 2008 |
Other
Other | 2008 International Conference on Dependable Systems and Networks, DSN-2008 |
---|---|
Country/Territory | United States |
City | Anchorage, AK |
Period | 6/24/08 → 6/27/08 |
ASJC Scopus subject areas
- Software
- Hardware and Architecture
- Computer Networks and Communications