1. osnaDocs
  2. Fachbereich 06 - Mathematik / Informatik / Physik
  3. FB06 - Hochschulschriften

Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity

Bitte benutzen Sie diese Kennung, um auf die Ressource zu verweisen:
https://osnadocs.ub.uni-osnabrueck.de/handle/urn:nbn:de:gbv:700-202105114440
Open Access logo originally created by the Public Library of Science (PLoS)
Langanzeige der Metadaten
DC ElementWertSprache
dc.creatorWitte, Tim Niklas-
dc.date.accessioned2021-05-11T09:47:30Z-
dc.date.available2021-05-11T09:47:30Z-
dc.date.issued2020-09-04-
dc.identifier.citationT. N. Witte, "Phantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activity," in IEEE Access, vol. 8, pp. 164428-164452, 2020ger
dc.identifier.urihttps://osnadocs.ub.uni-osnabrueck.de/handle/urn:nbn:de:gbv:700-202105114440-
dc.description.abstractState of the art malware detection techniques only consider the interaction of programs with the operating system's API (system calls) for malware classification. This paper demonstrates that techniques like these are insufficient. A point that is overlooked by the currently existing techniques is presented in this paper: Malware is able to interact with windows providing the corresponding functionality in order to execute the desired action by mimicking user activity. In other words, harmful actions will be masked as simulated user actions. To start with, the article introduces User Imitating techniques for concealing malicious commands of the malware as impersonated user activity. Thereafter, the concept of Phantom Malware will be presented: This malware is constantly applying User Imitating to execute each of its malicious actions. A Phantom Ransomware (ransomware employs the User Imitating for every of its malicious actions) is implemented in C++ for testing anti-virus programs in Windows 10. Software of various manufacturers are applied for testing purposes. All of them failed without exception. This paper analyzes the reasons why these products failed and further, presents measures that have been developed against Phantom Malware based on the test results.eng
dc.relationhttps://doi.org/10.1109/ACCESS.2020.3021743ger
dc.rightsAttribution 4.0 International*
dc.rights.urihttp://creativecommons.org/licenses/by/4.0/*
dc.subjectMalwareeng
dc.subjectransomwareeng
dc.subjectuser imitationeng
dc.subjectUI redressingeng
dc.subjectoverlay attackseng
dc.subjectBadUSBeng
dc.subjectobfuscationeng
dc.subjectbehavior blockerseng
dc.subject.ddc004 - Informatikger
dc.titlePhantom Malware: Conceal Malicious Actions From Malware Detection Techniques by Imitating User Activityeng
dc.typeEinzelbeitrag in einer wissenschaftlichen Zeitschrift [article]ger
orcid.creatorhttps://orcid.org/0000-0002-8727-9483-
dc.identifier.doi10.1109/ACCESS.2020.3021743-
Enthalten in den Sammlungen:FB06 - Hochschulschriften
Open-Access-Publikationsfonds

Dateien zu dieser Ressource:
Datei Beschreibung GrößeFormat 
IEEEAccess_Witte_2020.pdf1,86 MBAdobe PDF
IEEEAccess_Witte_2020.pdf
Miniaturbild
Öffnen/Anzeigen
Zur Kurzanzeige


Diese Ressource wurde unter folgender Copyright-Bestimmung veröffentlicht: Lizenz von Creative Commons Creative Commons