Although multiple techniques have been proposed with the goal of minimizing the semantic gap in virtual machine introspection, most concentrate on passive observation of the internal state, while there are also a number of proposals with which active modification of the VM's internal state is made possible. However there are issues when modifications are applied, such as keeping a consistent kernel state and avoiding a crash. In this article we propose Oxpecker, a VMI platform for transactional modification. The out-of-VM read access allows an introspector to detect malware in the guest OS (e.g., rootkit) and the transactional write access allows Oxpecker to reliably neutralize the detected threats. To begin a transaction, Oxpecker monitors VM state changes waiting for an idle moment which is free of possible race-conditions in the guest kernel memory. Thereafter, it invokes a VMI client's callback to proceed with reading/writing in its memory. Upon user request or possible exceptions, transaction is rolled back while the transaction ACID properties are maintained at all times. Oxpecker is implemented and evaluated under different real-world workloads. Additionally and as a practical example, a tool is developed, and open sourced, based on Oxpecker with which guest VM processes could be killed.

Summary Emergence of instrumentation frameworks has vastly contributed to the software engineering practices. As the instrumentation use cases become more complex, complexity of instrumenting programs also increases, leading to a higher risk of software defects, increased development time, and decreased maintainability. In security applications such as symbolic execution and taint analysis, which need to instrument a large number of instruction types, this complexity is prominent. This paper presents an architecture based on the Pin binary instrumentation framework to abstract the low‐level OS and hardware‐dependent implementation details, facilitate code reuse in heavyweight instrumentation use cases, and improve instrumenting program development time. Instructions of x86 and x86‐64 hardware architectures are formally categorized using the Z language based on the Pin framework API. This categorization is used to automate the instrumentation phase on the basis of a configuration list. Furthermore, instrumentation context data such as register data are modeled in an object‐oriented scheme. This makes it possible to focus the instrumenting program development time on writing the essential analysis logics while access to low‐level OS and hardware dependencies are streamlined. The proposed architecture is evaluated by instrumenting 135 instruction types in a concrete symbolic execution engine, resulting in a reduction of the instrumenting program size by 59.7%. Furthermore, performance overhead measure against the SPEC CINT2006 programs is limited to 8.7%.

Rootkit's main goal is to hide itself and other modules present in the malware. Their stealthy nature has made their detection further difficult, especially in the case of kernel-level rootkits. There have been many dynamic analysis techniques proposed for detecting kernel-level rootkits, while on the other hand, static analysis has not been popular. This is perhaps due to its poor performance in detecting malware in general, which could be attributed to the level of obfuscation employed in binaries which make static analysis difficult if not impossible. In this paper, we make two important observations, first there is usually little obfuscation used in legitimate kernel-level code, as opposed to the malicious kernel-level code. Second, one of the main approaches to penetrate the Windows operating system is through kernel-level drivers. Therefore, by focusing on detecting malicious kernel drivers employed by the rootkit, one could detect the rootkit while avoiding the issues with current detection technique. Given these two observation, we propose a simple static analysis technique with the aim of detecting malicious driver. We first study the current trends in the implementation of kernel-level rookits. Afterward, we proposed a set of features to quantify the malicious behavior in kernel drivers. These features are then evaluated through a set of experiments on 4420 malicious and legitimate drivers, obtaining an accuracy of 98.15% in distinguishing between these drivers.

Network forensic analysts employ payload attribution systems (PAS) as an investigative tool, which enables them to store and summarize large amounts of network traffic, including full packet payload. Hence an investigator could query the system for a specific string and check whether any of the packets transmitted previously in the network contained that specific string. As a shortcoming, the previously proposed techniques are unable to support wildcard queries. Wildcards are an important type of query that allow the investigator to locate strings in the payload when only part of the string is known. In this paper, a new data structure for payload attribution, named Character Dependent Multi-Bloom Filters, will be presented which, in addition to improving the previously proposed techniques, is able to support wildcard queries as well. To this end, a theoretical study of the proposed method was conducted in order to evaluate its false positive when responding to queries and subsequently the theoretical analysis is verified through a number of experiments. Furthermore, comparisons are made between the proposed method and the state-of-the-art attribution techniques presented in the literature. The results suggest that, using the Character Dependent Multi-Bloom Filters, one can obtain a data reduction ratio of about 265 : 1 opposed to 210 : 1 as obtained by the previously proposed state-of-the-art techniques assuming a similar false-positive rate. More importantly, the results indicate that a wildcard query with seven unknown characters would take approximately less than 1 second to process, using the proposed method; while given the previous techniques, as an exhaustive search is required, the same query takes about 4500 years to process.

Today P2P networks are responsible for a large amount of traffic on the Internet, as many Internet users employ such networks for content distribution. At the same time, P2P networks are vulnerable to security threats such as Internet worms and facilitate their propagation. Internet worms and more generally malware are a major concern to the network security community. There are many different type of worms in the wild, mostly categorized based on how they find and infect their new victims (i.e. active, passive, etc.). In this paper, we investigate a new approach for detecting passive worms and malware in P2P networks based on the popularity of files in the network. As part of our investigation, we crawl the Gnutella P2P network over a 12 day period collecting file names and file popularity statistics. We are then able to extract the highly popular files and identify worm/malware files within them with high accuracy.

The primary goal of image steganography techniques has been to maximize embedding rate while minimizing the detectability of the resulting stego images against steganalysis techniques. However, one particular advantage of steganography, as opposed to other information hiding techniques, is that the embedder has the freedom to choose a cover image that result in the least detectable stego image. This resource has largely remained unexploited in the proposed embedding techniques. In this paper, we study the problem of cover selection by investigating three scenarios in which the embedder has either no knowledge, partial knowledge, or full knowledge of the steganalysis technique. For example, we illustrate through experiments how simple statistical measures could help embedder minimize detectability, at times by 65%, in the partial knowledge case.

In this paper, we propose a novel approach to image steganography in which embedding is done without making explicit modifications to the image; that is, the embedding distortion introduced to the cover image is both perceptually and statistically ensured to be less detectable. If an image is divided into blocks and each block is hashed, then the hash values could represent the embedded message content. A set of replacement blocks can be obtained by consecutively capturing images of the same scene (or resampling the incident light). Since image content remains the same and noise is sampled, the set of replacements are statistically compatible while still providing unique hash values. With such an approach, the embedder can choose the block with hash value corresponding to the message content without violating any of the natural image statistics. When applied to JPEG images, experiments show that this technique can achieve embedding rates of 0.063 bits per DCT coefficient or 0.157 bits per nonzero DCT coefficient while still remaining undetectable by Farid's universal steganalysis tool.

One of the growing problems faced by network administrators is the abuse of computing resources by authorized and unauthorized personnel. The nature of abuse may vary from using unauthorized applications to serving unauthorized content. Proliferation of peer-to-peer networks and wide use of tunnels makes it difficult to detect such abuses and easy to circumvent security policies. This paper presents the design and implementation of a system, called Nabs, that characterizes content types of network flows based solely on the payload which can then be used to identify abuses of computing resources. The proposed method does not depend on packet headers or other simple packet characteristics hence is more robust to circumvention.

An interesting problem in digital forensics is that given a digital image, would it be possible to identify the camera model which was used to obtain the image. In this paper we look at a simplified version of this problem by trying to distinguish between images captured by a limited number of camera models. We propose a number of features which could be used by a classifier to identify the source camera of an image in a blind manner. We also provide experimental results and show reasonable accuracy in distinguishing images from the two and five different camera models using the proposed features.