Author: Christoph Csallner / Source: The Conversation
When malicious software attacks, computer scientists and security researchers want to know how the attackers got into what was supposed to be a secure system, and what they’re actually doing that’s causing problems for users. It’s a growing problem, affecting government projects, retail stores and individuals around the world.
However, fighting malware is a cyclical arms race: As defenders and analysts improve their methods, attackers step up their game, too. Today, as many as 80 percent of malware authors include elements in their attacks that specifically try to defeat malware-protection software.
My research group at the University of Texas at Arlington develops methods and tools professional malware analysts use to understand these attacks. One of our best-known efforts was led by alumna Shabnam Aboughadareh, who while she was working toward her Ph.D. developed a malware analysis tool that is particularly hard for malware authors to defend against.
Analyzing malware
When an attack is discovered or reported, malware analysts work to get a copy of any software that’s being installed on target computers. When they begin examining it, an early topic of inquiry is how the malware managed to break into a computer network or system. That often uncovers security holes in commonly used operating systems or applications – which can then be disclosed to those programs’ authors, who can fix the flaws.
In addition, analysts try to figure out what a piece of malware does once it breaks in – how it travels through a computer and throughout a network, and what actions it takes, such as altering files, copying data, running programs or even installing new software to assist itself in the attack. Those actions can be described in ways that help malware detection tools catch future attacks before they can do damage.
In observing a malware attack, we also try to determine which computers and which files have been manipulated, so they can be repaired. We also see what data – such as client lists, product plans or other sensitive business data – might have been read and copied by…
Click here to read more
