Extended abstract: Toward systematically exploring antivirus engines

Davide Quarta; Federico Salvioni; Andrea Continella; Stefano Zanero

doi:10.1007/978-3-319-93411-2_18

Extended abstract: Toward systematically exploring antivirus engines

Davide Quarta^*
, Federico Salvioni
, Andrea Continella
, Stefano Zanero

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

9 Citations (Scopus)

Abstract

While different works tested antiviruses (AVs) resilience to obfuscation techniques, no work studied AVs looking at the big picture, that is including their modern components (e.g., emulators, heuristics). As a matter of fact, it is still unclear how AVs work internally. In this paper, we investigate the current state of AVs proposing a methodology to explore AVs capabilities in a black-box fashion. First, we craft samples that trigger specific components in an AV engine, and then we leverage their detection outcome and label as a side channel to infer how such components work. To do this, we developed a framework, crAVe, to automatically test and explore the capabilities of generic AV engines. Finally, we tested and explored commercial AVs and obtained interesting insights on how they leverage their internal components.

Original language	English
Title of host publication	Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings
Editors	Cristiano Giuffrida, Sebastien Bardin, Gregory Blanc
Publisher	Springer
Pages	393-403
Number of pages	11
ISBN (Print)	9783319934105
DOIs	https://doi.org/10.1007/978-3-319-93411-2_18
Publication status	Published - 1 Jan 2018
Externally published	Yes
Event	15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2018 - Saclay, France Duration: 28 Jun 2018 → 29 Jun 2018 Conference number: 15

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	10885 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2018
Abbreviated title	DIMVA 2018
Country/Territory	France
City	Saclay
Period	28/06/18 → 29/06/18

Access to Document

10.1007/978-3-319-93411-2_18

Cite this

Quarta, D., Salvioni, F., Continella, A., & Zanero, S. (2018). Extended abstract: Toward systematically exploring antivirus engines. In C. Giuffrida, S. Bardin, & G. Blanc (Eds.), Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings (pp. 393-403). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10885 LNCS). Springer. https://doi.org/10.1007/978-3-319-93411-2_18

Quarta, Davide ; Salvioni, Federico ; Continella, Andrea et al. / Extended abstract : Toward systematically exploring antivirus engines. Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings. editor / Cristiano Giuffrida ; Sebastien Bardin ; Gregory Blanc. Springer, 2018. pp. 393-403 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{8da02ef531aa4a59a96fe00ed0d8f81d,

title = "Extended abstract: Toward systematically exploring antivirus engines",

abstract = "While different works tested antiviruses (AVs) resilience to obfuscation techniques, no work studied AVs looking at the big picture, that is including their modern components (e.g., emulators, heuristics). As a matter of fact, it is still unclear how AVs work internally. In this paper, we investigate the current state of AVs proposing a methodology to explore AVs capabilities in a black-box fashion. First, we craft samples that trigger specific components in an AV engine, and then we leverage their detection outcome and label as a side channel to infer how such components work. To do this, we developed a framework, crAVe, to automatically test and explore the capabilities of generic AV engines. Finally, we tested and explored commercial AVs and obtained interesting insights on how they leverage their internal components.",

author = "Davide Quarta and Federico Salvioni and Andrea Continella and Stefano Zanero",

year = "2018",

month = jan,

day = "1",

doi = "10.1007/978-3-319-93411-2\_18",

language = "English",

isbn = "9783319934105",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "393--403",

editor = "Cristiano Giuffrida and Sebastien Bardin and Gregory Blanc",

booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings",

address = "Germany",

note = "15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2018, DIMVA 2018 ; Conference date: 28-06-2018 Through 29-06-2018",

}

Quarta, D, Salvioni, F, Continella, A & Zanero, S 2018, Extended abstract: Toward systematically exploring antivirus engines. in C Giuffrida, S Bardin & G Blanc (eds), Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 10885 LNCS, Springer, pp. 393-403, 15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2018, Saclay, France, 28/06/18. https://doi.org/10.1007/978-3-319-93411-2_18

Extended abstract: Toward systematically exploring antivirus engines. / Quarta, Davide; Salvioni, Federico; Continella, Andrea et al.
Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings. ed. / Cristiano Giuffrida; Sebastien Bardin; Gregory Blanc. Springer, 2018. p. 393-403 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 10885 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Extended abstract

T2 - 15th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2018

AU - Quarta, Davide

AU - Salvioni, Federico

AU - Continella, Andrea

AU - Zanero, Stefano

N1 - Conference code: 15

PY - 2018/1/1

Y1 - 2018/1/1

N2 - While different works tested antiviruses (AVs) resilience to obfuscation techniques, no work studied AVs looking at the big picture, that is including their modern components (e.g., emulators, heuristics). As a matter of fact, it is still unclear how AVs work internally. In this paper, we investigate the current state of AVs proposing a methodology to explore AVs capabilities in a black-box fashion. First, we craft samples that trigger specific components in an AV engine, and then we leverage their detection outcome and label as a side channel to infer how such components work. To do this, we developed a framework, crAVe, to automatically test and explore the capabilities of generic AV engines. Finally, we tested and explored commercial AVs and obtained interesting insights on how they leverage their internal components.

AB - While different works tested antiviruses (AVs) resilience to obfuscation techniques, no work studied AVs looking at the big picture, that is including their modern components (e.g., emulators, heuristics). As a matter of fact, it is still unclear how AVs work internally. In this paper, we investigate the current state of AVs proposing a methodology to explore AVs capabilities in a black-box fashion. First, we craft samples that trigger specific components in an AV engine, and then we leverage their detection outcome and label as a side channel to infer how such components work. To do this, we developed a framework, crAVe, to automatically test and explore the capabilities of generic AV engines. Finally, we tested and explored commercial AVs and obtained interesting insights on how they leverage their internal components.

UR - https://www.scopus.com/pages/publications/85049345990

U2 - 10.1007/978-3-319-93411-2_18

DO - 10.1007/978-3-319-93411-2_18

M3 - Conference contribution

AN - SCOPUS:85049345990

SN - 9783319934105

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 393

EP - 403

BT - Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings

A2 - Giuffrida, Cristiano

A2 - Bardin, Sebastien

A2 - Blanc, Gregory

PB - Springer

Y2 - 28 June 2018 through 29 June 2018

ER -

Quarta D, Salvioni F, Continella A, Zanero S. Extended abstract: Toward systematically exploring antivirus engines. In Giuffrida C, Bardin S, Blanc G, editors, Detection of Intrusions and Malware, and Vulnerability Assessment - 15th International Conference, DIMVA 2018, Proceedings. Springer. 2018. p. 393-403. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-93411-2_18

Extended abstract: Toward systematically exploring antivirus engines

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this