Skip to Main content Skip to Navigation
Conference papers

Redirecting Malware’s Target Selection with Decoy Processes

Abstract : Honeypots attained the highest accuracy in detecting malware among all proposed anti-malware approaches. Their strength lies in the fact that they have no activity of their own, therefore any system or network activity on a honeypot is unequivocally detected as malicious. We found that the very strength of honeypots can be turned into their main weakness, namely the absence of activity can be leveraged to easily detect a honeypot. To that end, we describe a practical approach that uses live performance counters to detect a honeypot, as well as decoy I/O on machines in production. To counter this weakness, we designed and implemented the existence of decoy processes through operating system (OS) techniques that make safe interventions in the OS kernel. We also explored deep learning to characterize and build the performance fingerprint of a real process, which is then used to support its decoy counterpart against active probes by malware. We validated the effectiveness of decoy processes as integrated with a decoy Object Linking and Embedding for Process Control (OPC) server, and thus discuss our findings in the paper.
Document type :
Conference papers
Complete list of metadatas

Cited literature [16 references]  Display  Hide  Download

https://hal.inria.fr/hal-02384597
Contributor : Hal Ifip <>
Submitted on : Thursday, November 28, 2019 - 2:25:48 PM
Last modification on : Thursday, November 28, 2019 - 2:29:03 PM
Long-term archiving on: : Saturday, February 29, 2020 - 3:47:32 PM

File

 Restricted access
To satisfy the distribution rights of the publisher, the document is embargoed until : 2022-01-01

Please log in to resquest access to the document

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Sara Sutton, Garret Michilli, Julian Rrushi. Redirecting Malware’s Target Selection with Decoy Processes. 33th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jul 2019, Charleston, SC, United States. pp.398-417, ⟨10.1007/978-3-030-22479-0_21⟩. ⟨hal-02384597⟩

Share

Metrics

Record views

53