License: Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported license (CC BY-NC-ND 3.0)
When quoting this document, please refer to the following
DOI: 10.4230/OASIcs.TrustworthySW.2006.696
URN: urn:nbn:de:0030-drops-6960
URL: http://dagstuhl.sunsite.rwth-aachen.de/volltexte/2006/696/
Go to the corresponding OASIcs Volume Portal

Neuhaus, Stephan

Isolating Intrusions by Automatic Experiments

pdf-format:
06000.NeuhausStephan.ExtAbstract.696.pdf (0.02 MB)

Abstract

When dealing with malware infections, one of the first tasks is to find the processes that were involved in the attack. We introduce Malfor, a system that isolates those processes automatically. In contrast to other methods that help analyze attacks, Malfor works by experiments: first, we record the interaction of the system under attack; after the intrusion has been detected, we replay the recorded events in slightly different configurations to see which processes were relevant for the intrusion. This approach has three advantages over deductive approaches: first, the processes that are thus found have been experimentally shown to be relevant for the attack; second, the amount of evidence that must then be analyzed to find the attack vector is greatly reduced; and third, Malfor itself cannot make wrong deductions. In a first experiment, Malfor was able to extract the three processes responsible for an attack from 32 candidates in about six minutes.

BibTeX - Entry

@InProceedings{neuhaus:OASIcs:2006:696,
  author =	{Stephan Neuhaus},
  title =	{{Isolating Intrusions by Automatic Experiments}},
  booktitle =	{Workshop on Trustworthy Software},
  series =	{OpenAccess Series in Informatics (OASIcs)},
  ISBN =	{978-3-939897-02-6},
  ISSN =	{2190-6807},
  year =	{2006},
  volume =	{3},
  editor =	{Serge Autexier and Stephan Merz and Leon van der Torre and Reinhard Wilhelm and Pierre Wolper},
  publisher =	{Schloss Dagstuhl--Leibniz-Zentrum fuer Informatik},
  address =	{Dagstuhl, Germany},
  URL =		{http://drops.dagstuhl.de/opus/volltexte/2006/696},
  URN =		{urn:nbn:de:0030-drops-6960},
  doi =		{10.4230/OASIcs.TrustworthySW.2006.696},
  annote =	{Keywords: Intrusion Analysis, Malware, Experimentation}
}

Keywords: Intrusion Analysis, Malware, Experimentation
Collection: Workshop on Trustworthy Software
Issue Date: 2006
Date of publication: 26.09.2006

DROPS-Home | Fulltext Search | Imprint | Privacy Published by LZI