Dynamic Instruction Sequences Monitor for Virus Detection Jianyong Dai, Ratan Guha, Joohan Lee Wednesday, January 28, 2009 Cho, Ho-Gi

Abstract Dynamic instruction sequences monitor – refers to a special program which has the ability to launch a program and capture the runtime instruction sequence of that program Problem – none of them are specially designed to launch a potentially malicious program Solution – intercept certain Win32 API and divert it to a safe version of that API – provide virus detection plug-in mechanism [WePu07] 2

Dynamic instruction sequence monitor [WePu07] 3 DebuggerAnalyzingMonitor mainTarget LaunchSystem Malicious code or program InfectInfect

Solution – built a dynamic instruction sequences monitor with a protection mechanism intercept potentially destructive Win32 API and divert it to a safe version of that API provide some mechanism to keep the original execution path as much as possible – plug-in mechanism programmer can build different applications based on the dynamic instruction sequences captured by the monitor [WePu07] 4

System Architecture Overview [WePu07] 5Monitor mainTarget Launch … ReadFile(..) CreateFile(..) CheckFile(..) WriteFile(..) … Malicious code or program Interposition Binary sequences Classification Models CreateFile(..) CheckFile(..) WriteFile(..) Classification Models CreateFile(..) CheckFile(..) WriteFile(..) Compare and Decision

[WePu07] 6 Program Debugger Insulator Unknown Executable Disassembler Instruction processing Plug-in System Architecture for monitor Instruction Sequences Logic assembly construction Logic assembly construction Abstract assembly construction Abstract assembly construction Classification Decision Model Manager Classification Models Classification Models Structure of virus detection plug-in

Insulator – prevent certain Win32 API from executing – supply API with dummy output without actually invoking – use Microsoft Detour package [WePu07] 7 Return File and directory manipulation API Registry manipulation API Remote memory manipulation Remote thread creation Administration related API Socket creation, packet sending

Conclusion describe a dynamic instruction sequences monitor and a virus detection plug-in based the monitor – efficient and protect user computer in general case Problem – invoke the underlying ntdll.dll or interrupt 2E directly, which is not protected [WePu07] 8