Dynamic malware analysis using IntroVirt: a modified hypervisor-based system

Joshua S. White; Stephen R. Pape; Adam T. Meily; Richard M. Gloo

doi:10.1117/12.2015545

28 May 2013 Dynamic malware analysis using IntroVirt: a modified hypervisor-based system

Joshua S. White, Stephen R. Pape, Adam T. Meily, Richard M. Gloo

Proceedings Volume 8757, Cyber Sensing 2013; 87570D (2013) https://doi.org/10.1117/12.2015545
Event: SPIE Defense, Security, and Sensing, 2013, Baltimore, Maryland, United States

Abstract

In this paper, we present a system for Dynamic Malware Analysis which incorporates the use of IntroVirt™. IntroVirt is an introspective hypervisor architecture and infrastructure that supports advanced analysis techniques for stealth-malwareanalysis. This system allows for complete guest monitoring and interaction, including the manipulation and blocking of system calls. IntroVirt is capable of bypassing virtual machine detection capabilities of even the most sophisticated malware, by spoofing returns to system call responses. Additional fuzzing capabilities can be employed to detect both malware vulnerabilities and polymorphism.

Citation Download Citation

Joshua S. White, Stephen R. Pape, Adam T. Meily, and Richard M. Gloo "Dynamic malware analysis using IntroVirt: a modified hypervisor-based system", Proc. SPIE 8757, Cyber Sensing 2013, 87570D (28 May 2013); https://doi.org/10.1117/12.2015545

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available