Temporal search: Detecting hidden malware timebombs with virtual machines

Jedidiah R. Crandall, Gary Wassermann, Daniela A.S. De Oliveira, Zhendong Su, S. Felix Wu, Frederic T. Chong

Research output: Chapter in Book/Report/Conference proceedingConference contribution

24 Scopus citations

Abstract

Worms, viruses, and other malware can be ticking bombs counting down to a specific time, when they might, for example, delete files or download new instructions from a public web server. We propose a novel virtual-machine-based analysis technique to automatically discover the timetable of a piece of malware, or when events will be triggered, so that other types of analysis can discern what those events are. This information can be invaluable for responding to rapid malware, and automating its discovery can provide more accurate information with less delay than careful human analysis.Developing an automated system that produces the timetable of a piece of malware is a challenging research problem. In this paper, we describe our implementation of a key component of such a system: the discovery of timers without making assumptions about the integrity of the infected system's kernel. Our technique runs a virtual machine at slightly different rates of perceived time (time as seen by the virtual machine), and identifies time counters by correlating memory write frequency to timer interrupt frequency.We also analyze real malware to assess the feasibility of using full-system, machine-level symbolic execution on these timers to discover predicates. Because of the intricacies of the Gregorian calendar (leap years, different number of days in each month, etc.) these predicates will not be direct expressions on the timer but instead an annotated trace; so we formalize the calculation of a timetable as a weakest precondition calculation. Our analysis of six real worms sheds light on two challenges for future work: 1) time-dependent malware behavior often does not follow a linear timetable; and 2) that an attacker with knowledge of the analysis technique can evade analysis. Our current results are promising in that with simple symbolic execution we are able to discover predicates on the day of the month for four real worms. Then through more traditional manual analysis we conclude that a more control-flow-sensitive symbolic execution implementation would discover all predicates for the malware we analyzed.

Original languageEnglish (US)
Title of host publicationASPLOS XII
Subtitle of host publicationTwelfth International Conference on Architectural Support for Programming Languages and Operating Systems
Pages25-36
Number of pages12
DOIs
StatePublished - 2006
Externally publishedYes

Publication series

NameInternational Conference on Architectural Support for Programming Languages and Operating Systems - ASPLOS

Keywords

  • Malware
  • Virtual machines
  • Worms

ASJC Scopus subject areas

  • Software
  • Information Systems
  • Hardware and Architecture

Fingerprint Dive into the research topics of 'Temporal search: Detecting hidden malware timebombs with virtual machines'. Together they form a unique fingerprint.

Cite this