{"id":39972,"date":"2017-08-02T12:19:22","date_gmt":"2017-08-02T19:19:22","guid":{"rendered":"http:\/\/world.edu\/?p=39972"},"modified":"2017-08-02T12:19:22","modified_gmt":"2017-08-02T19:19:22","slug":"inside-fight-malware-attacks","status":"publish","type":"post","link":"https:\/\/world.edu\/inside-fight-malware-attacks\/","title":{"rendered":"Inside the fight against malware attacks"},"content":{"rendered":"

\"\"<\/p>\n

When malicious software attacks, computer scientists and security researchers want to know how the attackers got into what was supposed to be a secure system, and what they\u2019re actually doing that\u2019s causing problems for users. It\u2019s a growing problem, affecting government projects<\/a>, retail<\/a> stores<\/a> and individuals around the world<\/a>.<\/p>\n

However, fighting malware is a cyclical arms race: As defenders and analysts improve their methods, attackers step up their game, too. Today, as many as 80 percent of malware authors<\/a> include elements in their attacks that specifically try to defeat malware-protection software<\/a>.<\/p>\n

My research group at the University of Texas at Arlington<\/a> develops methods and tools professional malware analysts<\/a> use to understand these attacks. One of our best-known efforts was led by alumna Shabnam Aboughadareh, who while she was working toward her Ph.D. developed a malware analysis tool<\/a> that is particularly hard for malware authors to defend against.<\/p>\n

Analyzing malware<\/strong><\/p>\n

When an attack is discovered or reported, malware analysts work to get a copy of any software that\u2019s being installed on target computers. When they begin examining it, an early topic of inquiry is how the malware managed to break into a computer network or system. That often uncovers security holes<\/a> in commonly used operating systems or applications \u2013 which can then be disclosed to those programs\u2019 authors, who can fix the flaws<\/a>.<\/p>\n

In addition, analysts try to figure out what a piece of malware does<\/a> once it breaks in \u2013 how it travels through a computer and throughout a network, and what actions it takes, such as altering files, copying data, running programs or even installing new software to assist itself in the attack. Those actions can be described in ways that help malware detection tools catch future attacks<\/a> before they can do damage.<\/p>\n

In observing a malware attack, we also try to determine which computers and which files have been manipulated<\/a>, so they can be repaired. We also see what data \u2013 such as client lists, product plans or other sensitive business data \u2013 might have been read and copied by the malware<\/a>. And we often try to infer the attackers\u2019 identity<\/a>, or at least how advanced their skills are, to help prepare defenses against possible follow-up attacks.<\/p>\n

Running malicious code<\/strong><\/p>\n

Doing any of that requires us to watch the malware in action. It would be nice if we could simply decode the software and dissect its instructions without actually running these malicious programs. But malware authors know we\u2019ll be looking, so they take steps to make our jobs harder<\/a>, such as compressing or encrypting their malware programs before setting them loose.<\/p>\n

So our best option is to run the malware on our own computers. To prevent our own machines from being taken over or corrupted, though, we have to be careful. Typically we create what\u2019s called a \u201cvirtual machine<\/a>\u201d \u2013 a program that simulates a fully functional computer<\/a> but that does not have direct access to the computer\u2019s files and hardware. Ideally, that would let us observe all the actions the malware tries to take without actually harming our own computers.<\/p>\n

So far, however, there has been no single piece of software that can analyze every attack. Some malware programs operate on a very low technological level, working directly with very specific areas<\/a> of a computer\u2019s memory and hard drive storage systems, even changing how the computer works \u2013 so users can no longer trust the machines to do what is expected of them. Other malicious software works at higher levels, more like normal software that interacts with the operating system rather than the computer\u2019s hardware directly. The most advanced malware attacks on both levels<\/a>.<\/p>\n

Most analysis tools focus on one or the other of those types of attacks \u2013 but not both<\/a>. So they can\u2019t catch everything, and \u2013 even for the malware they do detect \u2013 can\u2019t show every action the malware takes. (Some analysis techniques involve running some anti-malware software in the virtual machine<\/a>, but those programs are vulnerable to manipulation from the malware itself.)<\/p>\n

Taking a fuller look<\/strong><\/p>\n

The program Shabnam Aboughadareh created, called SEMU, is the first malware analysis system that addresses all these problems. It operates fully outside the virtual machine, and watches closely what goes on inside it, to detect and log malware actions. That helps SEMU provide a comprehensive log of malware operations, which in turn reduces the manual effort required for a malware analyst to understand what the malware writer\u2019s program was supposed to do.<\/p>\n

That comprehensive log \u2013 recording events at the lowest levels of the virtual machine\u2019s operating system \u2013 is the key to SEMU\u2019s success, because it allows human analysts to track where and how malware manipulates aspects of the operating system.<\/p>\n

When we tested SEMU against other malware analysis tools, we found that SEMU was the only publicly available tool that could detect all the activity<\/a> \u2013 things like reading files, changing memory or file data, or sending information out over a network connection \u2013 needed to understand how the malware worked. By merging close examination of computer activity with detailed logging, and running in a safe environment where the malware couldn\u2019t tamper with its monitoring, SEMU shows a direction for future analysis methods.<\/p>\n

Author Bio:<\/strong> Christoph Csallner is an Associate Professor of Computer Science and Engineering at the University of Texas Arlington <\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

When malicious software attacks, computer scientists and security researchers want to know how the attackers got into what was supposed to be a secure system, and what they\u2019re actually doing that\u2019s causing problems for users. It\u2019s a growing problem, affecting government projects, retail stores and individuals around the world. However, fighting malware is a cyclical […]\n… learn more→<\/a><\/p>","protected":false},"author":33,"featured_media":39973,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[59],"tags":[12781],"coauthors":[11733],"class_list":["post-39972","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-science-tech","tag-malware-2"],"acf":[],"yoast_head":"\nInside the fight against malware attacks - World leading higher education information and services<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/world.edu\/inside-fight-malware-attacks\/\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:locale\" content=\"en_US\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:type\" content=\"article\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:title\" content=\"Inside the fight against malware attacks - World leading higher education information and services\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:description\" content=\"When malicious software attacks, computer scientists and security researchers want to know how the attackers got into what was supposed to be a secure system, and what they\u2019re actually doing that\u2019s causing problems for users. It\u2019s a growing problem, affecting government projects, retail stores and individuals around the world. However, fighting malware is a cyclical […]\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:url\" content=\"https:\/\/world.edu\/inside-fight-malware-attacks\/\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:site_name\" content=\"World leading higher education information and services\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"article:published_time\" content=\"2017-08-02T19:19:22+00:00\" class=\"yoast-seo-meta-tag\" \/>\n<meta property=\"og:image\" content=\"https:\/\/world.edu\/wp-content\/uploads\/2017\/08\/hackers.jpg\" class=\"yoast-seo-meta-tag\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" class=\"yoast-seo-meta-tag\" \/>\n\t<meta property=\"og:image:height\" content=\"265\" class=\"yoast-seo-meta-tag\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" class=\"yoast-seo-meta-tag\" \/>\n<meta name=\"author\" content=\"Kevin\" class=\"yoast-seo-meta-tag\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" class=\"yoast-seo-meta-tag\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kevin\" class=\"yoast-seo-meta-tag\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" class=\"yoast-seo-meta-tag\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" class=\"yoast-seo-meta-tag\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/\"},\"author\":{\"name\":\"Kevin\",\"@id\":\"https:\\\/\\\/world.edu\\\/#\\\/schema\\\/person\\\/42c1c1d5ff7ffbdf0bd50ed94c6ae6ee\"},\"headline\":\"Inside the fight against malware attacks\",\"datePublished\":\"2017-08-02T19:19:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/\"},\"wordCount\":896,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/world.edu\\\/wp-content\\\/uploads\\\/2017\\\/08\\\/hackers.jpg\",\"keywords\":[\"Malware\"],\"articleSection\":[\"Science and Technology\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/\",\"url\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/\",\"name\":\"Inside the fight against malware attacks - World leading higher education information and services\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/world.edu\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/world.edu\\\/wp-content\\\/uploads\\\/2017\\\/08\\\/hackers.jpg\",\"datePublished\":\"2017-08-02T19:19:22+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/world.edu\\\/#\\\/schema\\\/person\\\/42c1c1d5ff7ffbdf0bd50ed94c6ae6ee\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#primaryimage\",\"url\":\"https:\\\/\\\/world.edu\\\/wp-content\\\/uploads\\\/2017\\\/08\\\/hackers.jpg\",\"contentUrl\":\"https:\\\/\\\/world.edu\\\/wp-content\\\/uploads\\\/2017\\\/08\\\/hackers.jpg\",\"width\":680,\"height\":265},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/world.edu\\\/inside-fight-malware-attacks\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/world.edu\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Inside the fight against malware attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/world.edu\\\/#website\",\"url\":\"https:\\\/\\\/world.edu\\\/\",\"name\":\"World leading higher education information and services\",\"description\":\"Global Higher Education Jobs, University jobs, Lecturer & tenure jobs.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/world.edu\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/world.edu\\\/#\\\/schema\\\/person\\\/42c1c1d5ff7ffbdf0bd50ed94c6ae6ee\",\"name\":\"Kevin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1e8d491a5f9b9bf3db67c9e46abbba7bb06b26b458bd5025c55e0a4b9b60ea8a?s=96&d=mm&r=g8ba4c352a279c450aa9435d770c1ebf4\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1e8d491a5f9b9bf3db67c9e46abbba7bb06b26b458bd5025c55e0a4b9b60ea8a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1e8d491a5f9b9bf3db67c9e46abbba7bb06b26b458bd5025c55e0a4b9b60ea8a?s=96&d=mm&r=g\",\"caption\":\"Kevin\"},\"description\":\"Kevin is founder of the world.edu project. The past 28 years have been involved in publishing to the education sector in print and the internet. Kevin has a degree in Education and has a many years experience in developing companies and projects.\",\"sameAs\":[\"https:\\\/\\\/world.edu\"],\"url\":\"https:\\\/\\\/world.edu\\\/author\\\/kevin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Inside the fight against malware attacks - World leading higher education information and services","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/world.edu\/inside-fight-malware-attacks\/","og_locale":"en_US","og_type":"article","og_title":"Inside the fight against malware attacks - World leading higher education information and services","og_description":"When malicious software attacks, computer scientists and security researchers want to know how the attackers got into what was supposed to be a secure system, and what they\u2019re actually doing that\u2019s causing problems for users. It\u2019s a growing problem, affecting government projects, retail stores and individuals around the world. However, fighting malware is a cyclical […]","og_url":"https:\/\/world.edu\/inside-fight-malware-attacks\/","og_site_name":"World leading higher education information and services","article_published_time":"2017-08-02T19:19:22+00:00","og_image":[{"width":680,"height":265,"url":"https:\/\/world.edu\/wp-content\/uploads\/2017\/08\/hackers.jpg","type":"image\/jpeg"}],"author":"Kevin","twitter_misc":{"Written by":"Kevin","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#article","isPartOf":{"@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/"},"author":{"name":"Kevin","@id":"https:\/\/world.edu\/#\/schema\/person\/42c1c1d5ff7ffbdf0bd50ed94c6ae6ee"},"headline":"Inside the fight against malware attacks","datePublished":"2017-08-02T19:19:22+00:00","mainEntityOfPage":{"@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/"},"wordCount":896,"commentCount":0,"image":{"@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/world.edu\/wp-content\/uploads\/2017\/08\/hackers.jpg","keywords":["Malware"],"articleSection":["Science and Technology"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/","url":"https:\/\/world.edu\/inside-fight-malware-attacks\/","name":"Inside the fight against malware attacks - World leading higher education information and services","isPartOf":{"@id":"https:\/\/world.edu\/#website"},"primaryImageOfPage":{"@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#primaryimage"},"image":{"@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/world.edu\/wp-content\/uploads\/2017\/08\/hackers.jpg","datePublished":"2017-08-02T19:19:22+00:00","author":{"@id":"https:\/\/world.edu\/#\/schema\/person\/42c1c1d5ff7ffbdf0bd50ed94c6ae6ee"},"breadcrumb":{"@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/world.edu\/inside-fight-malware-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#primaryimage","url":"https:\/\/world.edu\/wp-content\/uploads\/2017\/08\/hackers.jpg","contentUrl":"https:\/\/world.edu\/wp-content\/uploads\/2017\/08\/hackers.jpg","width":680,"height":265},{"@type":"BreadcrumbList","@id":"https:\/\/world.edu\/inside-fight-malware-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/world.edu\/"},{"@type":"ListItem","position":2,"name":"Inside the fight against malware attacks"}]},{"@type":"WebSite","@id":"https:\/\/world.edu\/#website","url":"https:\/\/world.edu\/","name":"World leading higher education information and services","description":"Global Higher Education Jobs, University jobs, Lecturer & tenure jobs.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/world.edu\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/world.edu\/#\/schema\/person\/42c1c1d5ff7ffbdf0bd50ed94c6ae6ee","name":"Kevin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1e8d491a5f9b9bf3db67c9e46abbba7bb06b26b458bd5025c55e0a4b9b60ea8a?s=96&d=mm&r=g8ba4c352a279c450aa9435d770c1ebf4","url":"https:\/\/secure.gravatar.com\/avatar\/1e8d491a5f9b9bf3db67c9e46abbba7bb06b26b458bd5025c55e0a4b9b60ea8a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1e8d491a5f9b9bf3db67c9e46abbba7bb06b26b458bd5025c55e0a4b9b60ea8a?s=96&d=mm&r=g","caption":"Kevin"},"description":"Kevin is founder of the world.edu project. The past 28 years have been involved in publishing to the education sector in print and the internet. Kevin has a degree in Education and has a many years experience in developing companies and projects.","sameAs":["https:\/\/world.edu"],"url":"https:\/\/world.edu\/author\/kevin\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/posts\/39972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/comments?post=39972"}],"version-history":[{"count":0,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/posts\/39972\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/media\/39973"}],"wp:attachment":[{"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/media?parent=39972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/categories?post=39972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/tags?post=39972"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/world.edu\/wp-json\/wp\/v2\/coauthors?post=39972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}