Skip to Main Content
 

Global Search Box

 
 
 
 

Files

File List


osu1354523604.pdf (1.34 MB)

ETD Abstract Container

Abstract Header

Context-Aware Malicious Code Detection

Gu, Boxuan
http://rave.ohiolink.edu/etdc/view?acc_num=osu1354523604

Abstract Details

2012, Doctor of Philosophy, Ohio State University, Computer Science and Engineering.
Malicious codes are one of the biggest threats on the Internet according to the US-CERT vulnerability database. One salient example is Conficker, a malicious code targeting MS Windows that was released in 2009. Before it was discovered, millions of computers on the Internet were infected. Many approaches to malicious code detection have been proposed. However, such approaches have a key weakness: they do not leverage context information from target systems and input data in order to perform detection. Malicious codes can fully utilize context information for attack purposes, thereby evading detection. To address this issue, we propose a methodology that leverages such context information for malicious code detection. Based on this methodology, we design and implement three detection systems for malicious code detection on servers, Web browsers, and smartphones. Our first system takes ``snapshots'' of a target process's virtual memory space and leverages these snapshots to reveal malicious codes' true behaviors when consuming input data. Based on the first system, we construct the second system, which leverages Web browsers' JavaScript code execution environment to detect malicious JavaScript codes that exploit browsers' memory errors. Our third system uses an information flow tracking mechanism to detect malicious codes that steal sensitive information stored in smartphones. We comprehensively evaluate these detection systems with many real-world malicious codes. Our experimental results indicate that the context information can be used to greatly improve detection effectiveness with reasonable overhead.
Dong Xuan (Advisor)
Ten H. Lai (Committee Member)
Feng Qin (Committee Member)
128 p.
Computer Science
intrusion detection; malicious code detection; web security; javascript security; smartphone security; android security; information flow tracking; information leaking; worm detection; shellcode; shellcode detection;

Recommended Citations

Citations

  • Gu, B. (2012). Context-Aware Malicious Code Detection [Doctoral dissertation, Ohio State University]. OhioLINK Electronic Theses and Dissertations Center. http://rave.ohiolink.edu/etdc/view?acc_num=osu1354523604

    APA Style (7th edition)

  • Gu, Boxuan. Context-Aware Malicious Code Detection. 2012. Ohio State University, Doctoral dissertation. OhioLINK Electronic Theses and Dissertations Center, http://rave.ohiolink.edu/etdc/view?acc_num=osu1354523604.

    MLA Style (8th edition)

  • Gu, Boxuan. "Context-Aware Malicious Code Detection." Doctoral dissertation, Ohio State University, 2012. http://rave.ohiolink.edu/etdc/view?acc_num=osu1354523604

    Chicago Manual of Style (17th edition)

osu1354523604
820
© 2012, all rights reserved.
This open access ETD is published by The Ohio State University and OhioLINK.