一句话：提出 MalViz，一款通过进程监控事件分析恶意软件行为模式并追踪感染痕迹的交互式可视化工具。
本文介绍 MalViz，一个面向恶意软件行为分析的交互式可视化分析工具。它基于进程监控事件，旨在揭示运行中恶意软件相关进程之间的关系与依赖，帮助安全专家检测和识别异常签名模式，并定位恶意软件已触及甚至可能篡改的系统与用户库。作者在虚拟机环境中对四个恶意软件样本开展案例研究。结果表明，该可视化工具能有效支持软件与系统分析及数字取证专家刻画和观察恶意行为，并进一步识别受影响软件工件的痕迹。
This demonstration paper introduces MalViz, a visual analytic tool for analyzing malware behavioral patterns through process monitoring events. The goals of this tool are: 1) to investigate the relationship and dependencies among processes interacted with a running malware over a certain period of time, 2) to support professional security experts in detecting and recognizing unusual signature-based patterns exhibited by a running malware, and 3) to help users identify infected system and users' libraries that the malware has reached and possibly tampered. A case study is conducted in a virtual machine environment with a sample of four malware programs. The result of the case study shows that the visualization tool offers a great support for experts in software and system analysis and digital forensics to profile and observe malicious behavior and further identify the traces of affected software artifacts.
DOI 原文 ·
@inproceedings{paperbot4823,
title = {MalViz: an interactive visualization tool for tracing malware},
author = {Vinh The Nguyen and Akbar Siami Namin and Tommy Dang},
booktitle = {ISSTA},
year = {2018},
doi = {10.1145/3213846.3229501}
}