article · 2008

Ether: Malware Analysis via Hardware Virtualization Extensions

Artem Dinaburg, Paul Royal, Monirul Sharif, Wenke Lee

Cited by 0Abstract and details only

Abstract

Malware has become the centerpiece of most security threats on the Internet. Malware analysis is an essential technology that extracts the runtime behavior of malware, and supplies signatures to detection systems and provides evidence for recovery and cleanup. The focal point in the malware analysis battle is how to detect versus how to hide a malware analyzer from malware during runtime. State-of-the-art analyzers reside in or emulate part of the guest operating system and its underlying hardware, making them easy to detect and evade. In this paper, we propose a transparent and external approach to malware analysis, which is motivated by the intuition that for a malware analyzer to be transparent, it must not induce any side-effects that are unconditionally detectable by malware. Our analyzer, Ether, is based on a novel application of hardware virtualization extensions such as Intel VT, and resides completely outside of the target OS environment. Thus, there are no in-guest software components vulnerable to detection, and there are no shortcomings that arise from incomplete or inaccurate system emulation. Our experiments are based on our study of obfuscation techniques used to create 25,000 recent malware samples. The results show that Ether remains transparent and defeats the obfuscation tools that evade existing approaches.

Cite this paper

APA 7

Dinaburg, A., Royal, P., Sharif, M., & Lee, W. (2008). Ether: Malware Analysis via Hardware Virtualization Extensions.

MLA 9

Dinaburg, Artem, et al. “Ether: Malware Analysis via Hardware Virtualization Extensions.” 2008.

Chicago

Dinaburg, Artem, Paul Royal, Monirul Sharif, and Wenke Lee. 2008. “Ether: Malware Analysis via Hardware Virtualization Extensions.”

Harvard

Dinaburg, A. et al. (2008) ‘Ether: Malware Analysis via Hardware Virtualization Extensions’.

BibTeX

@article{dinaburg2008ether,
  title = {{Ether: Malware Analysis via Hardware Virtualization Extensions}},
  author = {Dinaburg, Artem and Royal, Paul and Sharif, Monirul and Lee, Wenke},
  year = {2008}
}

Made from the index record. Check names, capitalisation and page numbers against the paper. Need another style? AI for Research has over 10,000.