Detecting Stealth Software with Strider GhostBuster

Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of the Internet [XZ04]. Resource hiding is a powerful stealth technique commonly used by malware to evade detection by computer users and antimalware scanners. In this paper, we focus on a subclass of malware, termed “ghostware”, which hide files, configuration settings, processes, and loaded modules from the operating system’s query and enumeration Application Programming Interfaces (APIs). Instead of targeting individual stealth implementations, we describe a systematic framework for detecting multiple types of hidden resources by leveraging the hiding behavior as a detection mechanism. Specifically, we adopt a cross-view diff-based approach to ghostware detection by comparing a high-level infected scan with a low-level clean scan and alternatively comparing an inside-the-box infected scan with an outside-the-box clean scan. We describe the design and implem...

• Type: Conference
• Year: 2005
• Where: DSN
• Authors: Yi-Min Wang, Doug Beck, Binh Vo, Roussi Roussev, Chad Verbowski
• Keywords: Computer Networks, DSN 2005, Infected Scan, Malware, Stealth Malware Programs