6th European Conference - Academic Conferences

More documents

Recommendations

Info

Madhu Shankarapani and Srinivas Mukkamala Figure 4: Opcode instructions with entry points for the Trojan with custom made Zeus builder According to our observations though these two Trojans were created using different packers, their characteristics of using Windows API are almost similar. We observed the API call sequence of both the Trojans. When we applied distance measures after its API sequence alignment between them, we found they are about 92.32% similar to each other. This shows that irrespective of the obfuscation method used to create Zeus variants; our methodology can detect these Trojans. 4. Analysis methodology First, the Zeus sample is decompressed and passed through a PE file parser, producing the intermediate representation which consists of a Windows API calling sequence. This sequence is compared to a known malware sequence or signature (from the signature database) and is passed through the similarity measure module to generate the similarity report. The detection decision is made based on this similarity report. The PE binary parser transforms the PE binary file into an API calling sequence. It uses two components, W32Dasm version 8.9 and a text parser for disassembled code. W32Dasm by URSoftware Co. is a commercial disassembler, which disassembled the PE code and outputs assembly instructions, imported modules, imported API’s, and recourse information. The text parser parses the output from W32Dasm to a static API calling sequence, which becomes our signature. Table 1: Similarity analysis of Zeus/Zbot compared among different variants Tro jan. Troj Sp Troj an. Troj Troj Troj y.Z Troj an. Spy an.S an.S Troj an. eus Troj Troja an.B Zbo .Ze py.Z py.Z Troja Troja an.Z Spy. .1. an.Z n.Spy roke t- us. eus. eus. n.Zbo n.Spy bot- DHL Zeu Ge bot- .Zeus r- 134 1.G 1.Ge 1.Ge t- .Zeus 115 _DO s.1. n. 85. .2.Ge 12. 2.m en. n.m n.m 290. .1.Ge 1.m C.m Gen mal mal n.mal mal al mal al al mal n.mal al al .mal Trojan.Sp 10 y.Zeus.1. 0.0 51.9 92.3 70. 51. 71.2 60.9 79.8 71.2 47.7 Gen.mal 0 0 67.00 2 06 72 7 3 63.45 61.43 8 7 1 Trojan.Zb 46. 100. 51.2 58. 53. 70.3 52.4 63.5 69.5 45.3 ot-85.mal Trojan.Sp 83 00 58.19 7 00 44 9 6 56.69 42.69 3 0 3 y.Zeus.2. 41. 49.7 100.0 66.0 70. 66. 30.9 51.9 58.4 61.0 53.9 Gen.mal Trojan.Bro 31 2 0 3 78 95 9 1 88.23 60.26 9 7 0 ker- 49. 34.7 100. 43. 52. 38.2 44.1 64.6 44.0 38.8 12.mal 59 3 47.55 00 98 98 7 7 47.82 45.79 6 3 1 256
Trojan.Zb ot- 1342.mal Trojan.Sp y.Zeus.1. Gen.mal Trojan.Sp y.Zeus.1. Gen.mal Trojan.Sp y.Zeus.1. Gen.mal Trojan.Zb ot- 290.mal Trojan.Sp y.Zeus.1. Gen.mal Trojan.Zb ot- 1151.mal DHL_DO C.mal Trojan.Sp y.Zeus.1. Gen.mal MemScan Trojan.Sp y.Zeus.C. mal Trojan.Sp y.Zeus.1. Gen.mal Trojan.Zb ot- 1652.mal GenTroja n.Heur.Zb ot Zeus.mal Trojan.Sp y.Zeus.1. Gen.mal ZeuS_bin ary.mal ZeuS_bin ary.mal Trojan.Sp y.Zeus.1. Gen.mal Trojan.Zb ot- 2819.mal Trojan.Sp y.Zeus.1. Gen.mal Tro jan. Sp y.Z eus .1. Ge n. mal 58. 89 65. 58 54. 23 57. 96 29. 14 64. 30 65. 65 40. 35 52. 77 78. 75 75. 87 69. 79 71. 28 64. 18 51. 25 76. 05 70. 61 44. 52 52. 94 52. 74 Troj an.Z bot- 85. mal Madhu Shankarapani and Srinivas Mukkamala Troja n.Spy .Zeus .2.Ge n.mal 63.7 9 72.30 68.4 6 68.26 56.9 4 65.71 49.4 8 88.34 44.2 3 47.07 69.3 7 76.24 59.4 3 71.08 40.5 1 51.52 52.9 6 58.50 78.2 5 61.34 75.2 3 86.08 69.3 9 71.49 76.3 2 77.17 53.6 7 62.34 59.0 7 68.87 87.6 1 72.13 77.7 5 76.10 43.0 8 61.80 57.5 7 58.88 68.8 1 49.63 Troj an.B roke r- 12. mal 83.4 4 84.6 2 76.9 2 83.9 8 41.5 5 87.5 5 83.6 5 62.8 6 66.4 3 76.6 3 77.0 7 71.6 0 64.0 2 75.5 4 79.9 1 70.2 4 68.3 8 64.4 1 68.6 3 51.0 9 Troj an. Zbo t- 134 2.m al 100 .00 58. 25 74. 23 76. 37 34. 21 70. 67 75. 80 43. 59 79. 69 75. 13 74. 35 78. 77 76. 97 81. 87 69. 26 73. 69 69. 21 39. 01 64. 06 64. 13 Troj an. Spy .Ze us. 1.G en. mal 77. 09 100 .00 59. 96 59. 37 38. 33 70. 03 75. 86 52. 05 60. 01 79. 93 66. 52 73. 46 67. 71 65. 30 58. 36 79. 45 73. 13 46. 47 63. 33 64. 95 257 Troj an.S py.Z eus. 1.Ge n.m al 55.0 1 70.9 0 100. 00 67.5 2 30.2 3 64.6 9 61.8 1 40.0 0 64.7 5 71.8 8 71.0 9 74.1 7 77.2 0 72.5 4 53.3 1 67.9 8 70.0 6 41.9 1 67.5 3 71.1 3 Troj an.S py.Z eus. 1.Ge n.m al Troja n.Zbo t- 290. mal Troja n.Spy .Zeus .1.Ge n.mal 76.7 1 80.02 58.13 81.7 1 54.58 42.36 66.6 9 96.12 54.59 100. 00 51.16 54.44 53.7 3 74.6 3 61.09 100.0 0 21.68 100.0 0 63.1 1 62.5 61.11 57.36 6 66.98 41.70 78.7 2 76.44 60.37 84.0 5 85.10 80.75 72.3 5 53.98 63.05 85.2 8 92.50 70.64 70.9 9 69.1 79.78 75.07 2 75.56 69.18 78.0 0 67.8 64.52 65.70 4 75.0 67.21 70.49 0 51.33 61.99 47.0 1 36.19 27.44 71.3 3 41.23 49.47 64.1 8 85.66 48.82 Troj an.Z bot- 115 1.m al 81.3 8 74.6 0 62.0 7 79.1 0 42.6 4 79.6 6 100. 00 60.1 0 74.2 4 76.9 8 81.0 5 67.2 1 74.7 2 74.2 0 81.7 3 78.1 5 74.1 7 62.2 9 82.6 5 57.2 8 DHL _DO C.m al 94.4 6 82.9 1 73.7 4 66.5 3 68.1 3 86.2 4 59.7 3 100. 00 90.7 7 88.7 8 79.3 2 88.5 8 79.6 6 71.8 5 91.7 5 80.0 6 72.9 7 53.7 2 71.6 6 73.7 6 Troj an. Spy. Zeu s.1. Gen .mal 68.9 1 57.0 6 71.5 6 61.7 5 51.3 0 71.8 5 68.9 8 47.2 8 100. 00 86.4 1 77.8 9 83.5 2 85.1 6 72.7 1 59.1 7 79.5 9 68.1 6 41.1 5 57.5 6 70.8 3
Page 1 and 2:
The Proceedings of the 6th Internat
Page 3 and 4:
Contents Paper Title Author(s) Page
Page 5 and 6:
Preface These Proceedings are the w
Page 7 and 8:
Biographies of contributing authors
Page 9 and 10:
Department of Computer Science, IQR
Page 11 and 12:
Using the Longest Common Substring
Page 13 and 14:
Jaime Acosta Some techniques that u
Page 15 and 16:
Jaime Acosta assigned by an anti-vi
Page 17 and 18:
Jaime Acosta Cormen, T.H., Leiserso
Page 19 and 20:
Hind Al Falasi and Liren Zhang tran
Page 21 and 22:
Hind Al Falasi and Liren Zhang ther
Page 23 and 24:
Hind Al Falasi and Liren Zhang the
Page 25 and 26:
Edwin Leigh Armistead and Thomas Mu
Page 27 and 28:
Deception Operations Security (OPS
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
The Uses and Limits of Game Theory
Page 35 and 36:
3. Limits to using game theory 3.1
Page 37 and 38:
Merritt Baer Effective cyberintrusi
Page 39 and 40:
Merritt Baer 1.5), there seems to b
Page 41 and 42:
Merritt Baer Report of the Defense
Page 43 and 44:
Ivan Burke and Renier van Heerden F
Page 45 and 46:
Ivan Burke and Renier van Heerden a
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Marco Carvalho et al. systems start
Page 55 and 56:
Marco Carvalho et al. Benatallah, 2
Page 57 and 58:
Marco Carvalho et al. management la
Page 59 and 60:
Marco Carvalho et al. Figure 4: Sta
Page 61 and 62:
Marco Carvalho et al. Sorrels, D.,
Page 63 and 64:
Manoj Cherukuri and Srinivas Mukkam
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Mecealus Cronkrite et al. to see bo
Page 81 and 82:
Mecealus Cronkrite et al. trivial.
Page 83 and 84:
Mecealus Cronkrite et al. socially
Page 85 and 86:
Mecealus Cronkrite et al. The views
Page 87 and 88:
Vincent Garramone and Daniel Likari
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Stephen Groat et al. Sections 4 and
Page 97 and 98:
Stephen Groat et al. probability fo
Page 99 and 100:
Stephen Groat et al. host. In this
Page 101 and 102:
Stephen Groat et al. changing addre
Page 103 and 104:
Marthie Grobler et al. leadership,
Page 105 and 106:
Marthie Grobler et al. apply to sta
Page 107 and 108:
Marthie Grobler et al. 6. Working t
Page 109 and 110:
Cyber Strategy and the Law of Armed
Page 111 and 112:
Ulf Haeussler Alliance and Allies r
Page 113 and 114:
Ulf Haeussler following the invocat
Page 115 and 116:
Ulf Haeussler NCSA (2009) NCSA Supp
Page 117 and 118:
Karim Hamza and Van Dalen of respon
Page 119 and 120:
Karim Hamza and Van Dalen From a mi
Page 121 and 122:
Karim Hamza and Van Dalen productiv
Page 123 and 124:
Intelligence-Driven Computer Networ
Page 125 and 126:
Eric Hutchins et al. of defensive a
Page 127 and 128:
Eric Hutchins et al. Defenders can
Page 129 and 130:
Eric Hutchins et al. Equally as imp
Page 131 and 132:
Eric Hutchins et al. X-Mailer: Yaho
Page 133 and 134:
Eric Hutchins et al. Received: (qma
Page 135 and 136:
Eric Hutchins et al. U.S.-China Eco
Page 137 and 138:
Saara Jantunen and Aki-Mauri Huhtin
Page 139 and 140:
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Brian Jewell and Justin Beaver In t
Page 147 and 148:
Brian Jewell and Justin Beaver Figu
Page 149 and 150:
4. Evaluation Brian Jewell and Just
Page 151 and 152:
Brian Jewell and Justin Beaver othe
Page 153 and 154:
Detection of YASS Using Calibration
Page 155 and 156:
Kesav Kancherla and Srinivas Mukkam
Page 157 and 158:
M M M Su−2 Sv ∑∑ u= 1 v= 1 h(
Page 159 and 160:
5.2 ROC curves Kesav Kancherla and
Page 161 and 162:
Developing a Knowledge System for I
Page 163 and 164:
Louise Leenen et al. We distinction
Page 165 and 166:
Louise Leenen et al. There is growi
Page 167 and 168:
3.1 Needs analysis Louise Leenen et
Page 169 and 170:
Louise Leenen et al. Kroenke, D.M.
Page 171 and 172:
Jose Mas y Rubi et al. As we can se
Page 173 and 174:
Figure 2: CALEA forensic model (Pel
Page 175 and 176:
Jose Mas y Rubi et al. Table 2: Com
Page 177 and 178:
Jose Mas y Rubi et al. Another pend
Page 179 and 180:
Tree of Objectives Acknowledgements
Page 181 and 182:
Secure Proactive Recovery - a Hardw
Page 183 and 184:
Ruchika Mehresh et al. implementing
Page 185 and 186:
Ruchika Mehresh et al. The coordina
Page 187 and 188:
Ruchika Mehresh et al. multiplicati
Page 189 and 190:
Ruchika Mehresh et al. Table 2: App
Page 191 and 192:
2. Network infiltration detection D
Page 193 and 194:
David Merritt and Barry Mullins on
Page 195 and 196:
David Merritt and Barry Mullins Ess
Page 197 and 198:
David Merritt and Barry Mullins Dev
Page 199 and 200:
Muhammad Naveed Pakistan Computer E
Page 201 and 202:
Muhammad Naveed response could also
Page 203 and 204:
Muhammad Naveed Table 10: Aggressiv
Page 205 and 206:
Muhammad Naveed 2006 Tcp Open Mysql
Page 207 and 208:
Muhammad Naveed 8009 Tcp Open Ajp13
Page 209 and 210:
Muhammad Naveed Austalian Taxation
Page 211 and 212:
Alexandru Nitu world and bring it i
Page 213 and 214:
Alexandru Nitu Article 51 restricts
Page 215 and 216: Alexandru Nitu As IW strategy and t
Page 217 and 218: Cyberwarfare and Anonymity Christop
Page 219 and 220: Christopher Perr attacks again help
Page 221 and 222: Christopher Perr about the current
Page 223 and 224: Catch me if you can: Cyber Anonymit
Page 225 and 226: David Rohret and Michael Kraft reve
Page 227 and 228: David Rohret and Michael Kraft sary
Page 229 and 230: Data (Evidence) Removal Shield Davi
Page 231 and 232: Neutrality in the Context of Cyberw
Page 233 and 234: Julie Ryan and Daniel Ryan 18th cen
Page 235 and 236: Julie Ryan and Daniel Ryan “Decla
Page 237 and 238: Julie Ryan and Daniel Ryan von Glah
Page 239 and 240: Harm Schotanus et al. In the remain
Page 241 and 242: Harm Schotanus et al. 2.3.1 Secure
Page 243 and 244: Harm Schotanus et al. In this setup
Page 245 and 246: Harm Schotanus et al. the label (by
Page 247 and 248: Harm Schotanus et al. these aspects
Page 249 and 250: Maria Semmelrock-Picej et al. they
Page 251 and 252: Maria Semmelrock-Picej et al. User
Page 253 and 254: Maria Semmelrock-Picej et al. SPIKE
Page 255 and 256: Maria Semmelrock-Picej et al. A cl
Page 257 and 258: Maria Semmelrock-Picej et al. in co
Page 259 and 260: Maria Semmelrock-Picej et al. In th
Page 261 and 262: Maria Semmelrock-Picej et al. Fuchs
Page 263 and 264: Madhu Shankarapani and Srinivas Muk
Page 265: Figure 1: UPX packed Trojan Figure
Page 269 and 270: Madhu Shankarapani and Srinivas Muk
Page 271 and 272: Namosha Veerasamy and Marthie Grobl
Page 277 and 278: 4. Conclusion Namosha Veerasamy and
Page 279 and 280: Tanya Zlateva et al. Computer Infor
Page 281 and 282: Tanya Zlateva et al. security and v
Page 283 and 284: Tanya Zlateva et al. court opinions
Page 285 and 286: Tanya Zlateva et al. 5. Pedagogy, e
Page 287 and 288: PhD Research Papers 277
Page 289 and 290: Shada Alsalamah et al. Level 3 all
Page 291 and 292: Shada Alsalamah et al. assure the a
Page 293 and 294: Shada Alsalamah et al. for Health I
Page 295 and 296: 3. Hematology Laboratory System Who
Page 297 and 298: Shada Alsalamah et al. Pirnejad, H.
Page 299 and 300: Michael Bilzor a diverse base of U.
Page 301 and 302: Michael Bilzor In our current exper
Page 303 and 304: 5. Execution monitor theory Michael
Page 305 and 306: Michael Bilzor design was run in si
Page 307 and 308: Michael Bilzor over testbench metho
Page 309 and 310: Evan Dembskey and Elmarie Biermann
Page 317 and 318:
Theoretical Offensive Cyber Militia
Page 319 and 320:
Rain Ottis Last, but not least, it
Page 321 and 322:
Rain Ottis an infantry battalion, w
Page 323 and 324:
Rain Ottis Ottis, R. (2008) “Anal
Page 325 and 326:
Work in Progress Papers 315
Page 327 and 328:
Large-Scale Analysis of Continuous
Page 329 and 330:
References William Acosta Abadi, D.
Page 331 and 332:
Natarajan Vijayarangan top box unit
Page 333 and 334:
Natarajan Vijayarangan The proposed
show all

6th European Conference - Academic Conferences

Create successful ePaper yourself

Delete template?

Save as template?