Bridging the detection gap: a study on a behavior-based approach using malware techniques

<p>"In recent years the intensity and complexity of cyber attacks have increased at a rapid rate. The cost of these attacks on U.S. based companies is in the billions of dollars, including the loss of intellectual property and reputation. Novel and diverse approaches are needed to mitigate the cost of a security breach, and bridge the gap between malware detection and a security breach. This thesis focuses on the short term need to mitigate the impact of undetected shellcodes that cause security breaches. The thesis's approach focuses on the agents driving the attacks, capturing their actions, in order to piece together the attacks for forensics purposes, as well as to better understand the opponent. The work presented in this thesis employs models of normal operating system behavior to detect access to the operating system's shell interface. It also utilizes malware techniques to avoid detection and subsequent termination of the monitoring system, as well as dynamic shellcode execution methodologies in the testing of the thesis' modules to implement a monitoring system"--Document.</p>

Name thesis:degree_name

Master of Science (MS) in Computer Science

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Year

2014

Author dc:creator

• Palavicini, Geancarlo

• Computer security
• Malware (Computer software)
• Data protection
• Computer Sciences

Statement dc:rights

• Access is available to all users

Repository record dc:identifier

https://dc.ewu.edu/theses/186

OAI identifier oai:identifier

oai:dc.ewu.edu:theses-1185