syssec_red_book

12. Malwareequipped with auto-update functionality that allows malware operators to deployarbitrary code to the infected hosts. New malware versions are frequentlydeveloped and deployed; Panda Labs observed 73,000 new malware samplesper day in 2011 [67]. Clearly, the majority of these samples are not reallynew software but rather repacks or incremental updates of previous malware.Malware authors update their code in an endless arms race against securitycountermeasures such as anti-virus engines and spam filters. Furthermore, tosucceed in a crowded, competitive market they innovate, refining the malwareto better support cybercriminals’ modus operandi or to find new ways to profitat the expense of their victims. Understanding how malware is updated overtime by its authors is thus an interesting and challenging research problemwith practical applications. Previous work has focused on constructing thephylogeny of malware [208, 230]. However, quantifying the differences betweenversions can provide an indication of the development effort behind thisindustry, over the observation period. To provide deeper insight into malicioussoftware and its development, one needs to go a step further and identify howthe changes between malware versions relate to the functionality of the malware.This is the main challenge in today’s research. By utilizing techniquesthat combine dynamic and static code analysis to identify the component of amalware binary that is responsible for each behavior observed in a malwareexecution, the evolution of each component across malware versions can bemeasured. By comparing subsequent malware versions, code that is sharedwith previous versions and code that was added or removed can be identified.From the system-level activity, high-level behavior, such as downloading andexecuting a binary or harvesting email addresses, can be inferred. Aside fromrefining existing malware and introducing new techniques to evolve it, a certaintrend towards propagating malware to new platforms is certainly apparent.However, to date, Windows systems are still the main target of malware attacks.Even so, samples have started to trickle down to other operating systems, suchas Android or Mac OS. Given the growth of these markets, more sophisticatedforms of malicious code can be expected in the near future.12.6 Research GapsThe increasing sophistication of malware has exposed limitations in existingvirus scanners and malware detectors. Signature-based approaches cannotkeep up with malware variants that employ packing and polymorphism, necessitatingmore advanced malicious code scanning and analysis techniques.Approaches based on runtime behavioral profiling and detection are a promisingstep, and behavioral heuristics are supported to some extent by currentantivirus systems, but usually come as extra features not enabled by defaultdue to their increased runtime overhead and proneness to false alarms. Al-90