A Survey on malware analysis and mitigation techniques

Advanced Persistent Threats or APTs are big challenges to the security of government organizations or industry systems. These threats may result in stealth attacks, but if the attack is confronted before the attacker end goal has been achieved, the attackers could become aggressive by changing the mode of attack or by resorting to some form of contingency plan, which might cause unexpected damage. Therefore, the attack detection and the notification to the system administrator should be done surreptitiously. This paper presents an architecture, called Kidemonas, to silently detect the threat and secretly report it to the user or the system administrator. This way the attacker is deceived into carrying out the attack, without sending any clear signal so that the defender can buy time to develop countermeasures to deal with the attack. We consider several attack scenarios and perform a security analysis to demonstrate the features of Kidemonas.

Kidemonas: The Silent Guardian

This paper explores verification mechanisms, as well as confidence and security building measures, within the scope of existing conventional and strategic arms control regimes. In particular, it analyses the concepts of the Conventional Forces in Europe Treaty and the Vienna Document as an implementation regime for confidence and security building measures as well as the Open Skies Treaty, representing three major conventional arms control regimes. As an example for strategic arms control, we analyse the Chemical Weapons Convention. The objective of this paper is to identify those means and methods from these successful frameworks that can be adapted and potentially incorporated into a cyber-domain arms control regime. Based on this discussion, the authors suggest a general technical architecture for a trust-based future framework for arms control for cyberspace.

Arms control in cyberspace - architecture for a trust-based implementation framework based on conventional arms control methods

A Review on Malware Analysis for IoT and Android System

The concept of Trusted Computing offers a hardware platform based on which the integrity of IT systems is verified using a structured file-based signature hierarchy of all executable system components - from BIOS boot up to the execution of any user application. Current implementations detect integrity breaches at firmware and at file level so that suitable counter measures on a Trusted Computing system may be taken in almost real-time. This information - so far - either remains stored locally or in best case is forwarded at application layer leaving enough time for a smart malware to infect a peering system or to compromise application level communication. This paper introduces a new pro-active concept of integrity monitoring and reporting using the Trusted Platform Module to supervise the integrity of a system focusing on incident reporting to peering systems at link layer. For this concept we suggest the enhancement of the Trusted Platform Module by a new Attack Recognition Module to monitor a system in real time and to reliably notify peering systems about any integrity breach detected.

Markus Maybaum

Papers

ARMing the Trusted Platform Module pro-active system integrity monitoring focussing on peer system notification