Maitland: analysis of packed and encrypted malware via paravirtualization extensions
| dc.contributor.author | Benninger, Christopher Adam | |
| dc.contributor.supervisor | Coady, Yvonne | |
| dc.contributor.supervisor | Neville, Stephen William | |
| dc.date.accessioned | 2012-04-04T18:50:31Z | |
| dc.date.available | 2012-04-04T18:50:31Z | |
| dc.date.copyright | 2012 | en_US |
| dc.date.issued | 2012-04-04 | |
| dc.degree.department | Dept. of Computer Science | en_US |
| dc.degree.level | Master of Science M.Sc. | en_US |
| dc.description.abstract | Malicious software (malware) attacks are an ever-increasing cyber-security problem. One reason for this trend is the widespread adoption of packing technology as a way to mask the semantics of binary instructions, hiding them from detection. Packing is so successful that it is estimated 70-80% of malicious programs utilize it to avoid detection [1]. The popularity of virtualization provides new tools for dealing with this threat. Researchers have successfully used facilities provided by virtualization to develop new ways of detecting and analyzing packed and encrypted malware. Methods like these typically require changes to the virtualization platform, making them difficult to deploy as well as hard to reuse. This thesis presents Maitland, a proof-of-concept unpacking system which achieves similar functionality to existing research, using paravirtualization extensions instead of requiring changes to the hypervisor. During our experiments, Maitland successfully exposed instructions in software that was packed by the UPX and gzexe packers. Maitland’s avoidance of changes to the hypervisor means it is better suited for quick deployment in a cloud environment. | en_US |
| dc.description.scholarlevel | Graduate | en_US |
| dc.identifier.uri | http://hdl.handle.net/1828/3866 | |
| dc.language | English | eng |
| dc.language.iso | en | en_US |
| dc.rights.temp | Available to the World Wide Web | en_US |
| dc.subject | malware | en_US |
| dc.subject | virtualization | en_US |
| dc.subject | paravirtualization | en_US |
| dc.subject | cloud | en_US |
| dc.subject | Xen | en_US |
| dc.subject | Linux | en_US |
| dc.title | Maitland: analysis of packed and encrypted malware via paravirtualization extensions | en_US |
| dc.type | Thesis | en_US |
Files
Original bundle
1 - 1 of 1
Loading...
- Name:
- Benninger_Christopher_MSc_2012.pdf
- Size:
- 601.63 KB
- Format:
- Adobe Portable Document Format
- Description:
- Thesis
License bundle
1 - 1 of 1
No Thumbnail Available
- Name:
- license.txt
- Size:
- 1.74 KB
- Format:
- Item-specific license agreed upon to submission
- Description: