My talk at Federal University of Minas Gerais (UFMG) to present some aspects of modern malware research and some of my contributions to the field (derived from my PhD defense). I cover all steps of a detection pipelines: threat hunting, malware triage, sandbox execution, threat intelligence, and endpoint protection.

1. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Among Viruses, Trojans, and Backdoors
Fighting Malware in 2022
Marcus Botacin
1mfbotacin@inf.ufpr.br
mfbotacin@gmail.com
marcusbotacin.github.io
Among Viruses, Trojans, and Backdoors 1 / 47 UFMG

2. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Who Am I?
PhD. in Computer Science (2021) - Federal University of Paraná (UFPR), Brazil
Thesis: “On the Malware Detection Problem: Challenges and new Approaches”
MSc. in Computer Science (2017) - University of Campinas (UNICAMP), Brazil
Dissertation: “Hardware-Assisted Malware Analysis”
Computer Engineer (2015) - University of Campinas (UNICAMP), Brazil
Final Project: “Malware detection via syscall patterns identification”
Among Viruses, Trojans, and Backdoors 2 / 47 UFMG

3. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Malware Detection
How have we been doing?
Among Viruses, Trojans, and Backdoors 3 / 47 UFMG

4. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
How have we been doing? (Malware Specifics)
The good side
Figure: Source:
https://apnews.com/article/europe-ma
lware-netherlands-coronavirus-pandem
ic-7de5f74120a968bd0a5bee3c57899fed
The bad side
Figure: Source:
https://thehackernews.com/2021/06/dr
oidmorph-shows-popular-android.html
Among Viruses, Trojans, and Backdoors 4 / 47 UFMG

5. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Malware Detection:
What have we been doing?
Among Viruses, Trojans, and Backdoors 5 / 47 UFMG

6. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
The State-of-the-art in Malware Detection & Prevention
Steps
1 Collection
2 Triage
3 Sandbox Analysis
4 Threat Intelligence
5 Endpoint Protection
Distributed Processing
Collection
Cloud Processing
Analysis and Intelligence steps
Limited Processing
Endpoint
Among Viruses, Trojans, and Backdoors 6 / 47 UFMG

7. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Collection
How to find new malware samples?
Searching “dark web” forums.
Crawling software repositories.
Leveraging honeypots.
Checking spam traps.
Downloading Malware repositories.
Scrapping blocklists.
The result
Figure: Source:
https://www.forbes.com/sites/thomasb
rewster/2021/09/29/google-play-warni
ng-200-android-apps-stole-millions
-from-10-million-phones/
Among Viruses, Trojans, and Backdoors 7 / 47 UFMG

8. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Triage
Why how many new malware samples?
Variations from the same source
code.
Implications
Increase processing costs and
response time.
How to solve this problem?
Identify and cluster similar samples.
The Statistics
Figure: Source:
https://www.kaspersky.com/about/pres
s-releases/2020 the-number-of-new-m
alicious-files-detected-every-day-
increases-by-52-to-360000-in-2020
Among Viruses, Trojans, and Backdoors 8 / 47 UFMG

9. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Sandbox Analysis
Goals
Uncover hidden
behaviors.
Method
Trace sample
execution.
Challenge
Handle evasion
attempts.
Solution 1
Figure: https://blog.vir
ustotal.com/2019/05/vi
rustotal-multisandbox-
yoroi-yomi.html
Solution 2
Figure: https:
//blog.virustotal.com/
2019/07/virustotal-mul
tisandbox-sndbox.html
Among Viruses, Trojans, and Backdoors 9 / 47 UFMG

10. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Threat Intelligence
Goal
Identify trends and predict attacks.
How?
Data analytics over analyzed
samples.
Challenges
Look to a representative dataset.
We should look to:
Figure: Source:
https://www.computerweekly.com/news/
252504676/Ransomware-attacks-increas
e-dramatically-during-2021
Among Viruses, Trojans, and Backdoors 10 / 47 UFMG

11. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Malware Detection
Endpoint Protection
Goal
Protect customers in their machines.
How?
Moving the viable analyses to the
endpoint.
Challenges
Performance and usability
constraints.
Is there a “best”?
Figure: Source: https://www.av-test.or
g/en/antivirus/home-windows/
Among Viruses, Trojans, and Backdoors 11 / 47 UFMG

12. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Sandboxing
Enhancing Malware Tracing
Among Viruses, Trojans, and Backdoors 12 / 47 UFMG

13. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Sandboxing
Publication
Figure: Link: https://link.springer.com/article/10.1007/s11416-017-0292-8
Among Viruses, Trojans, and Backdoors 13 / 47 UFMG

14. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Sandboxing
Software-based Sandbox
Figure: System Architecture. Analysis VMs.
Among Viruses, Trojans, and Backdoors 14 / 47 UFMG

15. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Sandboxing
Publication
Figure: Link: https://dl.acm.org/doi/10.1145/3152162
Among Viruses, Trojans, and Backdoors 15 / 47 UFMG

16. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Sandboxing
Hardware-based Sandbox
Monitoring Steps
1 Software executes a branch.
2 Processor stores branch address in
memory page.
3 Processor raises an interrupt.
4 Kernel handles interrupt.
5 Kernel sends data to userland.
6 Userland introspects into this data.
Figure: System Architecture.
Among Viruses, Trojans, and Backdoors 16 / 47 UFMG

17. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Sandboxing
Key Insight: Branches define basic blocks
Figure: Identified branches and basic
blocks.
Figure: CFG Reconstruction.
Among Viruses, Trojans, and Backdoors 17 / 47 UFMG

18. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Threat Intelligence
From Tracing to Threat Intelligence
Among Viruses, Trojans, and Backdoors 18 / 47 UFMG

19. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Threat Intelligence
Publications
Figure: Link: https:
//dl.acm.org/doi/10.1145/3429741
Figure: Link: https://dl.acm.org/doi/1
0.1145/3339252.3340103
Among Viruses, Trojans, and Backdoors 19 / 47 UFMG

20. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Threat Intelligence
Brazilian Financial Malware on Desktop
Figure: Passive Banker Malware for
Santander bank waiting for user’s
credential input.
Figure: Passive Banker Malware for Itaú
bank waiting for user’s credential input.
Among Viruses, Trojans, and Backdoors 20 / 47 UFMG

21. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Threat Intelligence
Brazilian Financial Malware on Mobile
Figure: BB’s Whatsapp chatbot. Figure: Bradesco’s Whatsapp chatbot.
Among Viruses, Trojans, and Backdoors 21 / 47 UFMG

22. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Threat Intelligence
More about Brazilian Malware
Figure: Link:
https://www.usenix.org/conference/enigma2021/presentation/botacin
Among Viruses, Trojans, and Backdoors 22 / 47 UFMG

23. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
From Threat Intelligence to Endpoint
Protection
Among Viruses, Trojans, and Backdoors 23 / 47 UFMG

24. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
Publication
Figure: Link:
https://www.sciencedirect.com/science/article/pii/S0167404821003242
Among Viruses, Trojans, and Backdoors 24 / 47 UFMG

25. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
Drawback: Real-time monitoring performance penalty
0
50
100
150
200
250
Perl Xalanc Gobmk H264 Namd Mcf
Time
(s)
Benchmark
AV’s Monitoring Performance
Filter AV SSDT AV No AV
Figure: AV Monitoring Performance.
0
50
100
150
200
250
300
perl namd Bzip milc mfc
Execution
Time
(s)
Benchmark
AV scanning overhead
Scan
Baseline
Figure: In-memory AV scans worst-case
and best-case performance penalties.
Among Viruses, Trojans, and Backdoors 25 / 47 UFMG

26. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
Publication
Figure: Link: https://ieeexplore.ieee.org/document/9034972
Among Viruses, Trojans, and Backdoors 26 / 47 UFMG

27. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
SMC-Aware Processor
Figure: Sample Profiling. Figure: System Overview.
Among Viruses, Trojans, and Backdoors 27 / 47 UFMG

28. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
Publication
Figure: Link: https://link.springer.com/article/10.1007/s11416-020-00348-w
Among Viruses, Trojans, and Backdoors 28 / 47 UFMG

29. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
SMC-Aware Processor
Figure: Modified Cache. Figure: Modified MMU.
Among Viruses, Trojans, and Backdoors 29 / 47 UFMG

30. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
Publication
Figure: Link:
https://www.sciencedirect.com/science/article/abs/pii/S0957417422004882
Among Viruses, Trojans, and Backdoors 30 / 47 UFMG

31. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Endpoint Protection
A first idea: Hardware features as signatures
Figure: Two-level branch predictor. A
sequence window of taken (1) and not-taken
(0) branches is stored in the Global History
Register (GHR).
0
10
20
30
40
50
60
70
80
90
100
8 16 24 32 40
Percentage
of
signature
collision
in
the
k−bit
space
Branch pattern length (in k bits)
Percentage of signature collision per branch−pattern length (in bits)
Patterns
Figure: Branch patterns coverage.
Among Viruses, Trojans, and Backdoors 31 / 47 UFMG

32. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Solutions Availability
Solutions Availability
Among Viruses, Trojans, and Backdoors 32 / 47 UFMG

33. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Solutions Availability
Code: The BranchMonitoring Project
Figure: Link: https://github.com/marcusbotacin/BranchMonitoringProject
Among Viruses, Trojans, and Backdoors 33 / 47 UFMG

34. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Solutions Availability
Service: Corvus Platform
Figure: Link: corvus.inf.ufpr.br Figure: Corvus’ Threat Intelligence.
Among Viruses, Trojans, and Backdoors 34 / 47 UFMG

35. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Current Projects
Current Research:
Malware Decompilation
Among Viruses, Trojans, and Backdoors 35 / 47 UFMG

36. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Current Projects
Publication
Figure: Link: https://dl.acm.org/doi/10.1145/3375894.3375895
Among Viruses, Trojans, and Backdoors 36 / 47 UFMG

37. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Current Projects
Decompilation Execution Example 1
Data Extraction
Debugging with GDB.
Decompilation
Lifting with Python.
Recompilation
Using GCC.
Among Viruses, Trojans, and Backdoors 37 / 47 UFMG

38. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Current Projects
Publication
Figure: Link: https://arxiv.org/abs/2109.06127
Among Viruses, Trojans, and Backdoors 38 / 47 UFMG

39. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Current Projects
Decompilation Execution Example 1
Figure: Malware Source-Code. Figure: Generated Patch.
Among Viruses, Trojans, and Backdoors 39 / 47 UFMG

40. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
Machine Learning:
The Latest Trend
Among Viruses, Trojans, and Backdoors 40 / 47 UFMG

41. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
Malware Evasion Competition
Figure: Source: mlsec.io
Figure: Source: https:
//www.microsoft.com/security/blog/20
21/07/29/attack-ai-systems-in-machin
e-learning-evasion-competition/
Among Viruses, Trojans, and Backdoors 41 / 47 UFMG

42. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
Adversarial Machine Learning
Figure: Source: https://github.com/marcusbotacin/Talks/tree/master/Waikato
Among Viruses, Trojans, and Backdoors 42 / 47 UFMG

43. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
Adversarial Malware
Figure: Dropper Strategy. Figure: Data Appendix Result.
Among Viruses, Trojans, and Backdoors 43 / 47 UFMG

44. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
Challenge Results
Figure: Defenders Challenge.
Among Viruses, Trojans, and Backdoors 44 / 47 UFMG

45. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
Challenge Results
Figure: Attackers Challenge.
Among Viruses, Trojans, and Backdoors 45 / 47 UFMG

46. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Machine Learning
What’s Next?
Among Viruses, Trojans, and Backdoors 46 / 47 UFMG

47. Introduction Contributions Moving Forward Current Research Future Challenges Conclusions
Recap & Remarks
Thanks!
Questions? Comments?
@MarcusBotacin
mfbotacin@inf.ufpr.br
mfbotacin@gmail.com
marcusbotacin.github.io
corvus.inf.ufpr.br
Among Viruses, Trojans, and Backdoors 47 / 47 UFMG