TRUMANBOX: improving dynamic malware analysis by emulating the internet

Authors:
Christian Gorecki;Felix C. Freiling;Marc Kührer;Thorsten Holz
Affiliations:
AGT Germany;Friedrich-Alexander-University Erlangen-Nuremberg;Ruhr-University Bochum;Ruhr-University Bochum
Venue:
SSS'11 Proceedings of the 13th international conference on Stabilization, safety, and security of distributed systems
Year:
2011

Citing 5
Cited 0

A virtual honeypot framework

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Toward Automated Dynamic Malware Analysis Using CWSandbox

IEEE Security and Privacy
Toward botnet mesocosms

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
Virtual honeypots: from botnet tracking to intrusion detection

Virtual honeypots: from botnet tracking to intrusion detection
The Honeywall CD-ROM

IEEE Security and Privacy

Quantified Score

Hi-index	0.00

Visualization

Abstract

Dynamic analysis of malicious software (malware) is a powerful tool in countering modern threats on the Internet. In dynamic analysis, a malware sample is executed in a controlled environment and its actions are logged. Through dynamic analysis, an analyst can quickly obtain an overview of malware behavior and can decide whether or not to indulge into tedious manual analysis of the sample. However, usual dynamic analysis exposes the Internet to the threats of an executed malware (like portscans) because advanced concealment techniques of malware often require full Internet access. For example, a missing link to the Internet or the unavailability of a specific server often causes the malware to not trigger its malicious behavior. In this paper, we present TRUMANBOX, a technique to emulate relevant parts of the Internet to enhance dynamic malware analysis. We show that TRUMANBOX not only prevents many threats but also enlarges the scope of the types of malware that can be analyzed dynamically.