Date of Award
1-20-2020
Publication Type
Master Thesis
Degree Name
M.Sc.
Department
Computer Science
Supervisor
Sherif Saad
Rights
info:eu-repo/semantics/openAccess
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Abstract
Advancement in computing technologies made malware development easier for malware authors. Unconventional computing paradigms such as cloud computing, the internet of things, In-memory computing, etc. introduced new ways to develop more complex and effective malware. To demonstrate this, we designed and implemented a fileless malware that could infect any device that supports JavaScript and HTML5. In addition, another proof-of-concept is implemented that signifies the security threat of in-memory malware for in-memory data storage and computing platforms. Furthermore, a detailed analysis of unconventional malware has been performed using current state-of-the-art malware analysis and detection techniques. Our analysis shows that, by utilizing the unique characteristics of emerging technologies, malware attacks could easily deceive the anti-malware tools and evade themselves from detection. This clearly demonstrates the need for an innovative and effective detection mechanism. Because of the limitations of existing techniques, we propose a hybrid approach using specification-based and behavioral analysis techniques together as an effective solution against unconventional and emerging malware instances. Our approach begins with the specification development where we present the way of writing it in a succinct manner to describe the expected behavior of the application. Moreover, the behavior monitoring component of our approach makes the detection mechanism effective enough by matching the actual behavior with pre-defined specifications at run-time and alarms the system if any action violates the expected behavior. We demonstrate the effectiveness of the proposed approach by applying it for the detection of in-memory malware that threatens the HazelCast in-memory data grid platform. In our experiments, we evaluated the performance and effectiveness of the approach by considering the possible use cases where in-memory malware could affect the data present in the storage space of HazelCast IMDG.
Recommended Citation
Babar, Farhan Mahmood, "Emerging & Unconventional Malware Detection Using a Hybrid Approach" (2020). Electronic Theses and Dissertations. 8294.
https://scholar.uwindsor.ca/etd/8294