发布求助
文献互助 智能选刊 最新文献

2011 6th International Conference on Malicious and Unwanted Software最新文献

筛选
英文 中文
DroidDreamLight lurks behind legitimate Android apps DroidDreamLight潜伏在合法的Android应用程序背后
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-12-27 DOI: 10.1109/MALWARE.2011.6112329
Mark Balanza, Kervin Alintanahin, Oscar Abendan, J. Dizon, Bernadette Caraig
{"title":"DroidDreamLight lurks behind legitimate Android apps","authors":"Mark Balanza, Kervin Alintanahin, Oscar Abendan, J. Dizon, Bernadette Caraig","doi":"10.1109/MALWARE.2011.6112329","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112329","url":null,"abstract":"Legitimate Android apps that have been modified to carry malicious code have become a common sight in the Android Market and so pose serious security threats to all Android-based device users. We analyzed one particular malware known as DroidDreamLight and compiled our findings in this paper. DroidDreamLight, which affected 30,000–120,000 users in May 2011, is capable of stealing users' personal information and of sending stolen data to cybercriminals.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-12-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116761748","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 21
Secure service distribution for VErsatile Service-Oriented Wireless Mesh Networks 面向服务的多用途无线网状网络的安全服务分配
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112331
H. Lugo-Cordero, R. Guha, K. Lu, D. Rodríguez
{"title":"Secure service distribution for VErsatile Service-Oriented Wireless Mesh Networks","authors":"H. Lugo-Cordero, R. Guha, K. Lu, D. Rodríguez","doi":"10.1109/MALWARE.2011.6112331","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112331","url":null,"abstract":"Service-Oriented Architecture (SOA) has been recently proposed, to optimize the locality of services. Within SOA, the main goal is to provide optimal service experience, rather than connection between two end points. Traditional SOA however, relies on XML message exchange, which makes it not suitable for nodes with no web processing capabilities. This paper introduces a secure service distribution system for VErsatile Service-Oriented Wireless Mesh Networks (VESO-Mesh), named VESO-DRS. VESO-DRS uses a hash table approach to provide confidentiality and preservation of integrity of resources in the mesh network. VESO-DRS also implements secure indexing for preserving confidentiality resources, and data may be searched and recovered via a novel resource ranking scheme. Results show that VESO-DRS can prevent unauthorized modifications to the resources, preserving their integrity; such resources are distributed across the mesh, yielding higher storage to all nodes.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124780956","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Distributed malware analysis scheduling 分布式恶意软件分析调度
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112324
R. Branco, Gabriel Negreira Barbosa
{"title":"Distributed malware analysis scheduling","authors":"R. Branco, Gabriel Negreira Barbosa","doi":"10.1109/MALWARE.2011.6112324","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112324","url":null,"abstract":"Automation of malware analysis is a complex challenge faced by researchers due to the growing number of unique malware samples. For this automation to succeed, the algorithm used in the scheduling decisions must be reliable and efficient to better use the available resources. In this paper we discuss our distributed approach in details, showing the reasoning behind each part composing the scheduler, the distribution of jobs and the analysis results.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124416461","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Multiprocess malware 多进程的恶意软件
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112320
M. Ramilli, M. Bishop, Shining Sun
{"title":"Multiprocess malware","authors":"M. Ramilli, M. Bishop, Shining Sun","doi":"10.1109/MALWARE.2011.6112320","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112320","url":null,"abstract":"Malware behavior detectors observe the behavior of suspected malware by emulating its execution or executing it in a sandbox or other restrictive, instrumented environment. This assumes that the process, or process family, being monitored will exhibit the targeted behavior if it contains malware. We describe a technique for evading such detection by distributing the malware over multiple processes. We then present a method for countering this technique, and present results of tests that validate our claims.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"63 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128921287","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
Testing protections against web threats 测试针对web威胁的保护
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112322
F. Leitold
{"title":"Testing protections against web threats","authors":"F. Leitold","doi":"10.1109/MALWARE.2011.6112322","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112322","url":null,"abstract":"The number of web threats increased in large measure in the last few years. It is not related to the PC based threats only, new operating systems of handy devices are in danger as well. In this paper testing methods of web threat protections are discussed. A unique anti-malware testing procedure has been developed under the aegis of CheckVir Lab. This testing procedure can provide actual comparative test results of anti-malware solutions automatically for the IT user community on the web and in addition other manually or semi-automatically executed tests can provide more details about the knowledge of the tested products as well. These methods can provide results soon after the new version of a particular version of an anti-malware solution is released. The real-time automatic testing is based on a set of dedicated PCs continuously checking the possible updates and they are dealing with executing the predefined testing jobs.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"302 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115219946","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
A recoverable hybrid C&C botnet 一个可恢复的混合型C&C僵尸网络
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112334
Chaoge Liu, Weiqing Lu, Zhiqi Zhang, Peng Liao, Xiang Cui
{"title":"A recoverable hybrid C&C botnet","authors":"Chaoge Liu, Weiqing Lu, Zhiqi Zhang, Peng Liao, Xiang Cui","doi":"10.1109/MALWARE.2011.6112334","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112334","url":null,"abstract":"In this paper, we introduce the possible design of such a botnet called CoolBot which exploits a novel hybrid command and control (C&C) structure — hybrid P2P and URL Flux. The proposed CoolBot would have extremely desirable features — robustness and recoverability, that is, it could not only defend against popular attacks such as Sybil and routing table pollution attack but also could recover its C&C channel in a tolerable delay in case most of critical resources are destroyed, which promise to be appealing for botmasters. Our preliminary results show that the design of CoolBot is feasible and hard to defend against, consequently posing potential threat for Internet security. The goal of our work is to increase the understanding of advanced botnets which will promote the development of more efficient countermeasures. To conclude our paper, we suggest possible defenses against the emerging threat.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134152471","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Phishing by form: The abuse of form sites 通过表单进行网络钓鱼:滥用表单网站
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112332
Hugo Gonzalez-Robledo, K. Nance, Jose Nazario
{"title":"Phishing by form: The abuse of form sites","authors":"Hugo Gonzalez-Robledo, K. Nance, Jose Nazario","doi":"10.1109/MALWARE.2011.6112332","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112332","url":null,"abstract":"The evolution of phishing methods has resulted in a plethora of new tools and techniques to coerce users into providing credentials, generally for nefarious purposes. This paper discusses the relatively recent emergence of an evolutionary phishing technique called phishing by form that relies on the abuse of online forms to elicit information from the target population. We evaluate a phishing corpus of emails and over a year's worth of phishing URLs to investigate the methodology, history, spread, origins, and life cycle as well as identifying directions for future research in this area. Our analysis finds that these hosted sites represent less than 1% of all phishing URLs, appear to have shorter active lifetimes, and focus mainly on email account credential theft. We also provide defensive recommendations for these free application sites and users.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133050954","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Android platform based linux kernel rootkit 基于Android平台的linux内核rootkit
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112330
Dong-Hoon You, Bongnam Noh
{"title":"Android platform based linux kernel rootkit","authors":"Dong-Hoon You, Bongnam Noh","doi":"10.1109/MALWARE.2011.6112330","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112330","url":null,"abstract":"Android with linux kernel is on its way to be a standard platform of various smart devices. Therefore, Android platform based linux kernel rootkit will be a major security threat to smart phones, tablet PCs, smart TVs and so on. Although there is an urgent need of remedy for this threat, no solution or even a suitable study has been announced. In this paper, we are going to depict some rootkits which exploit android kernel by taking advantage of LKM(loadable kernel module) and /dev/kmem device access technology and discuss the danger the rootkit attack would bring.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122415014","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 34
Exploring network-based malware classification 探索基于网络的恶意软件分类
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112321
Natalia Stakhanova, Mathieu Couture, A. Ghorbani
{"title":"Exploring network-based malware classification","authors":"Natalia Stakhanova, Mathieu Couture, A. Ghorbani","doi":"10.1109/MALWARE.2011.6112321","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112321","url":null,"abstract":"Over the last years, dynamic and static malware analysis techniques have made significant progress. Majority of the existing analysis systems primarily focus on internal host activity. In spite of the importance of network activity, only a limited set of analysis tools have recently started taking it into account. In this work, we study the value of network activity for malware classification by various antivirus products. Specifically, we ask the following question: How well can we classify malware according to network activity? We monitor the execution of a malware sample in a controlled environment and summarize the obtained high-level network information in a graph. We then analyze graphs similarity to determine whether such high-level behavioral profile is sufficient to provide accurate classification of mal-ware samples. The experimental study on a real-world mal-ware collection demonstrates that our approach is able to group malware samples that behave similarly.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"117 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132310172","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 15
Evaluating security products based on appropriate usage 基于适当的使用评估安全产品
2011 6th International Conference on Malicious and Unwanted Software Pub Date : 2011-10-18 DOI: 10.1109/MALWARE.2011.6112323
V. Phatak, Rick Moy
{"title":"Evaluating security products based on appropriate usage","authors":"V. Phatak, Rick Moy","doi":"10.1109/MALWARE.2011.6112323","DOIUrl":"https://doi.org/10.1109/MALWARE.2011.6112323","url":null,"abstract":"Information security products have evolved rapidly over the last decade. However, the science of evaluating products has virtually stood still during that same time period, creating a knowledge gap that has made it difficult for information security buyers to determine whether or not a product meets specific security and/or compliance needs. This paper discusses a new method for evaluating technology products based upon the appropriateness within the context that they will be deployed. By applying a Use Case-based methodology, information security professionals can more clearly identify detailed protection requirements for a given environment. Two examples are given: (1) Use Cases can clarify different application security requirements between retail storefronts and back-end e-commerce datacenters; and (2) Use Cases allow the assessment of anti-malware products based on the relative importance of different malware attack vectors to the endpoints being protected.","PeriodicalId":375300,"journal":{"name":"2011 6th International Conference on Malicious and Unwanted Software","volume":"16 8","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-10-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"120822306","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
下一页 尾页
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整，为了账户安全，请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们：info@booksci.cn Book学术提供免费学术资源搜索服务，方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号：604180095
Book学术官方微信