Anti malware* Engine

Information Sharing Talk (IST)

*should we avoid using

term virus as catch all term for Malware

*Why not two antivirus (anti malware) on a system

Classify
Blacklisting
Detect bad objects Can not be perfect as problem itself is un-decidable Signature (reactive mechanism) Heuristics
Dynamic Static parameters

Whitelisting
Allow only good and block the remaining ones Can be solved theoretically but practically challenging
Anti malware engine 2

How an anti malware works

Behavior Based Engine (On Process Activities) Behaviors database

Basic Activity Scanning *

Anti Virus Scanning (On file content)

Malware Signature database

White listing (On process creation) ( * Process activity, file read or write )
Anti malware engine

Known Applications database

3

Design Problems
Scanning for clean file need to be faster Scanning or disinfecting malware may take a long Where to keep the database while scanning
Tradeoff between memory and file IO

Engines differ for desktop and mobiles Preprocessing helps but

Will make booting slower
Anti malware engine 4

Scanning
Static
Scan/Analysis of a file structure and contents Methods
On demand On access

Dynamic
Monitoring while target is executing Emulate
Anti malware engine 5

Components of AV engine
Malware.zip UNARCHIVER PE Parser

Malware.exe Un packer File type recognizer

Signature scanning and heuristics

Clean
Anti malware engine

infected
6

Scanning Techniques
String scanning Hash scanning Virus specific scanning Heuristics Emulation
Used with other techniques

Anti malware engine

String Scanning
Native Scanning O(nm) Boyer Moore O(n) Aho Corasick Algorithm

a a

b b

c a b

Anti malware engine

Aho-Carsick
Set Matching Problem
Pattern to search P = {P1, P2, ., Pk} in Target T = {1, ., m}
k

n = i=1 |Pi|
A multiple string matching algorithm that constructs a finite state machine from a pattern (list of keywords), then uses the machine to locate all occurrences of the keywords in a body of text. O(m + n + z) where z is the number of patter occurrences in T
Anti malware engine 9

Hash scanning
Take a hash of full file
Can not work for file infectors Slow Single junk byte appended in malware will deny detection

Use (start, length) pair for calculating hash

If length is short
False Positives

Long
Lot of disk access
Anti malware engine 10

Start position
It can be Arbitrary point It can be fixed
PE Entry Point Beginning of the file Beginning of the code section Beginning of an exported function

There can be many unique pairs

Makes the scan slower
Anti malware engine 11

Heuristics
Enabling a person to discover or learn for themselves Relating to a speculative formulation serving as a guide in the investigation or solution of a problem

Anti malware engine

12

Anti malware engine

13

Heuristics methods
Strategy
Dynamic Static

Subject of Analysis

Behavior

Structure

Analysis Methods

Weights

Rules

Anti malware engine

14

Weights Based
Activity Weight

Rules Based
1. Small Executable AND Runs A SERVER

Network server
Disable system tools

2
5

2. Kill AV Process AND contains decryption loop

3. Packed Executable and deleted self 4. Suspicious Double Extension (for e.g. amazingshoots.jpeg.exe) 5. Program Runs from Temp directory AND Creates new executable in Windows 6.

Hidden process
Writes to HOSTS File Creating executables NO GUI Sends HTTP Sends IRC

7
3 2 1 2 5

7.

Anti malware engine

15

Script malware
A script host program is generally used to run the scripts
Perl myscript.pl msiexec.exe myinstall.msi iexplore.exe mysc.js

Threat will be shown in process running Approach of Behavior learning will generate false positives in this case Simplest solution is to look at command line
However not possible in many cases (WINWORD etc.)
Anti malware engine 16

Otherwise
Script NORMALIZER

PARSER/ Analyzer

Emulator

Clean

Rating Logic
Malware

Anti malware engine

17

Behavior Blocker
Of course not all provide same protection Commonly known as HIPS = Host Intrusion Prevention System HIPS monitors application make
Sequence of system calls Parameters passed into a call

HIPS Decision Logic

Ask user to decide Use heuristic methods Use Both
Anti malware engine 18

Root kit Detection

Cross View Diff
We use a variant of it Low FP rate

Hook Detection
Good hooking is common (ENSAFE) Can not be a decision point to Quarantine But very important for security Not allowed on many Linux systems and 64 Bit Windows

Static Analysis
Sequence which hooks AND Sequence which manipulates EPRCESS pointers

Hooking Behavior is monitored

Can take a decision from user

Anti malware engine

19