The volume and the sophistication of malware are continuously increasing and evolving. Automated dynamic malware analysis is a widely-adopted approach for detecting malicious software. However, many recent malware samples try to evade detection by identifying the presence of the analysis environment itself, and refraining from performing malicious actions. Because of the sophistication of the techniques used by the malware authors, so far the analysis and detection of evasive malware has been largely a manual process. One approach to automatic detection of these evasive malware samples is to execute the same sample in multiple analysis environments, and then compare its behaviors, in the assumption that a deviation in the behavior is evidence of an attempt to evade one or more analysis systems. For this reason, it is important to provide a reference system (often called bare-metal) in which the malware is analyzed without the use of any detectable component. In this paper, we present BareCloud, an automated evasive malware detection system based on bare-metal dynamic malware analysis. Our bare-metal analysis system does not introduce any in-guest monitoring component into the malware execution platform. This makes our approach more transparent and robust against sophisticated evasion techniques. We compare the malware behavior observed in the bare-metal system with other popular malware analysis systems. We introduce a novel approach of hierarchical similarity-based malware behavior comparison to analyze the behavior of a sample in the various analysis systems. Our experiments show that our approach produces better evasion detection results compared to previous methods. BareCloud was able to automatically detect 5,835 evasive malware out of 110,005 recent samples.
@inproceedings{Kirat2015Barecloud_Bare-metal,
title = {{Barecloud: Bare-metal Analysis-based Evasive Malware Detection}},
author = {Kirat, Dhilung and Vigna, Giovanni and Kruegel, Christopher},
booktitle = {Proceedings of the 23rd USENIX Conference on Security Symposium},
series = {SEC'14},
year = {2014},
address = {Berkeley, CA, USA},
isbn = {978-1-931971-15-7},
pages = {287--301},
publisher = {USENIX Association},
url = {http://dl.acm.org/citation.cfm?id=2671225.2671244}
}