Upload File

property directed test case generation · 2016. 11. 1. · malware case study. pdtg useful for...

  • Home
  • Documents
  • Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate
12
Property Directed Test Case Generation © 2016 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Property Directed Test Case Generation Dr. Arie Gurfinkel Dr. Edward Schwartz Dr. William Klieber Jeffrey Gennari

Upload: others

Post on 12-Aug-2021

6 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

1Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

Property Directed Test Case GenerationDr. Arie GurfinkelDr. Edward SchwartzDr. William KlieberJeffrey Gennari

Page 2: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

2Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

DisclaimerCopyright 2016 Carnegie Mellon University

This material is based upon work funded and supported by DoD/SEI LENS under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development centersponsored by the United States Department of Defense.

Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of DoD/SEI LENS or the United States Department of Defense.

NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.

[Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution.

This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at [email protected].

DM-0004040

Page 3: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

3Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Big Picture: Generating Test Case Input is Complex

Software evaluations often include creating test cases to trigger interesting behaviors•Finding bugs, ensuring critical functionality executes, determining if unwanted functionality is present, etc.

Traditional test case generation requires testers to provide specific inputs, run tests, and evaluate results•Trial and error•Complex and time consuming

What input is needed to trigger

behavior …

Program Source Code or Specification

Program input needed to

trigger behavior

Page 4: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

4Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Test Case Generation and Model Checking

Model checkers use program abstractions to exhaustively check a program for specified properties• For example, can the system get into a bad state; if so, how?

Model checkers produce traces to show how a property is, or is not satisfied• Required program models very abstract• Specified properties often expressed in complex, mathematical terms• Returned traces are abstract and hard to operationalize

Software Model Checker

Trace

Abstract Program Model

PropertyProgram input needed

to trigger behavior

Page 5: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

5Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

PDTG

Property Directed Test Case Generation (PDTG)

Goal: Instead of relying on human-driven trial and error or interpreting abstract results from model checkers we will automatically generate executables to trigger desired behavior• Provide evaluators with concrete evidence demonstrating a property is present

• Give evaluators an executable artifact showing how to trigger the property

Executable

Program’s source code

augmented to flag areas of

interest

Page 6: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

6Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Property Directed Test Case Generation (PDTG)

Model checker produces counter example (trace) showing how to reach property• Seahorn

- http://seahorn.github.io/

Software Model Checker

Directed Symbolic Execution

Executable Harness

Executable

Trace

PDTGProgram’s

source code augmented to flag areas of

interest

http://seahorn.github.io/
Page 7: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

7Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Property Directed Test Case Generation (PDTG)

Executable harness implements external methods needed to execute path in traceKLEE fuses together trace with values from executable harness to produce valid executable

• Resulting executable deterministically triggers property

Software Model Checker

Directed Symbolic Execution

Executable Harness

Executable

Trace

PDTGProgram’s

source code augmented to flag areas of

interest

Page 8: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

8Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Example Harnessif (get_input() == 0x1234 &&

get_input() == 0x8765) {__VERIFIER_error();

} else {return 0;

}

void get_input () {static int x = 0;switch (x++) {case 0: return 0x1234;case 1: return 0x8765;default: assert(false); }

}

• get_input() is an external function

• Program considered buggy if and only if __VERIFIER_error() is reachable

• Implementation of external functions linked to original source code

• Causes program to execute __VERIFIER_error()

Page 9: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

9Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Generating Harnesses for Linux Device Driversvoid *ldv_undef_ptr(void){void *tmp;tmp = __c();return tmp;

}////////////////////////void *is_got = ldv_undef_ptr();if (is_got <= (long)2012) { ... }

• Samples from Linux Driver Verification (LDV) project

• Harness functions returning pointers are tricky- May not be reasonable addresses- Might return “new” memory

• Original program instrumented with memory read/store hooks that control access to external memory- Still working on general solution

Page 10: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

10Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Malware Case Study

PDTG useful for malware analysis• Force execution of suspected malicious code

- For example, generate an executable to trigger malware’s information stealing features

• Automatically construct program entry point to call function(s) needed to trigger behavior of interest- Set all conditions required to reach behavior

• Tested on Gh0st RAT malware

define i32 @main()entry %0 = call %class.CSystemManager @__sea_get_arg()call void @_ZN14CSystemManager9OnReceiveEPhj(%class.CSystemManager* %0)ret i32 0

Generate main function to trigger behavior

Page 11: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

11Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Conclusions

We implemented the PDTG prototype to discover interesting behaviors, generate harnesses, and produce working executables• Completed malware case study demonstrating usefulness of approach• Evaluated PDTG using Linux Driver Verification (LDV) Benchmarks

- http://forge.ispras.ru/projects/ldv

Results based on 27 files in ldv-validator-0.8

File Count Results

6 Successfully generated executable to demonstrate property of interest (i.e. trigger known bug)

7 Successfully proved buggy code was unreachable

6 Timeout

5 Memory exhausted

3 Bogged down in complex memory operations

http://forge.ispras.ru/projects/ldv
Page 12: Property Directed Test Case Generation · 2016. 11. 1. · Malware Case Study. PDTG useful for malware analysis •Force execution of suspected malicious code - For example, generate

12Property Directed Test Case Generation© 2016 Carnegie Mellon University

[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.

SEI Research Review 2016

Acknowledgements

We would like to thank our collaborators on this project• Carnegie Mellon University

- Dr. Temegshen Kahsai- Dr. Limin Jia- Jiaqi Liu

• NASA- Dr. Jorge Navas


The Case of the Mistaken Malware

SECURITY REIMAGINED - Digital News Asia · 2015-11-18 · The Most Prevalent Malware in Southeast Asia 5 Southeast Asia’s Leading Industries Attracting APT Malware 6 Regional Case

Modeling the Propagation of Trojan Malware in Online ...the malware from their systems, as in the case of a large-scale attack on Facebook caused by a malware named Magnet [9]. All

Tracking surreptitious malware distribution …2012.zeronights.org/includes/docs/Yarochkin, Kropotov, Chetvertakov...Tracking surreptitious malware distribution channels Case study

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE

LAZARUS UNDER THE HOOD - Threatpost · Sony Pictures Entertainment hack and a strong similarity in the malware tools. Sometime later, ... The only case where malware targeting the

Malware Analysis. A Case Study

Reversing malware analysis training part8 malware memory forensics

Practical Malware Analysis: Ch 11: Malware Behavior

Malware & Anti-Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Andrei Costin and Jonas Zaddach Framework and Case Studies ... · Jonas Zaddach Malware researcher at Talos Working on IoT malware analysis and analysis automation. Agenda Introduction

Intezer- leading telco case study - Genetic Malware Analysis · Intezer introduces a Genetic Malware Analysis approach, offering enterprises unparalleled and accelerated incident

SPLUNK SECURITY USE CASE DETECTING UNKNOWN … · WHITE PAPER SPLUNK SECURITY USE CASE DETECTING UNKNOWN MALWARE AND RANSOMWARE Detecting unknown malware and ransomware…

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Analisis dan Deteksi Malware Menggunakan Metode Malware

Instrumenting Point-of-Sale Malware - DEF CON® …...nstrumenting Point-of-Sale Malware: A Case Study in Communicating Malware Analysis More Effectively, Wesley McGrew, DEFCON, DEF

A case study in Android malware

scikit-learn Case Study - Penn State College of Engineeringpdm12/cse597g-f15/slides/cse597g-machine-learning-2.pdf · Page Malware Classification • "A difficult challenge of anti-malware

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

1 Automated malware audit service Automatischer Malware Audit

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL …czou/research/email-Malware-TDSC14.pdf · Case 4: both self-start mechanism in modern email malware. We assume a user

Reversing malware analysis trainingpart9 advanced malware analysis

Windows Malware Firewall: Remove Windows Malware Firewall

Intrusion Detection and Malware Analysis - Malware collection

Malware Armoring: The case against incident related binary analysis