Understanding and Measuring Inter-Process Code Injection in Windows Malware

Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

80 Downloads (Pure)

Abstract

Malware aims to stay undetected for as long as possible. One common method for avoiding or delaying detection is the use of code injection, by which a malicious process injects code into another running application. Despite code injection being known as one of the main features of today’s malware, it is often overlooked and no prior research performed a comprehensive study to fundamentally understand and measure code injection in Windows malware. In this paper, we conduct a systematic study of code injection techniques and propose the first taxonomy to group these methods into classes based on common traits. Then, we leverage our taxonomy to implement models of the studied techniques and collect empirical evidence for the prevalence of each specific technique in the malware scene. Finally, we perform a large-scale, longitudinal measurement of the adoption of code injection, highlighting that at least 9.1% of Windows malware between 2017 and 2021 performs code injection. Our systematization and results show that Process Hollowing is the most commonly used technique across different malware families, but, more importantly, this trend is shifting towards other, less traditional methods. We conclude with takeaways that impact how future malware research should be conducted. Without comprehensively accounting for code injection and modeling emerging techniques, future studies based on dynamic analysis are bound to limited observations.
Original languageEnglish
Title of host publicationProceedings of the International Conference on Security and Privacy in Communication Networks (SecureComm 2023)
Number of pages23
Publication statusPublished - 1 Oct 2023
Event19th International Conference on Security and Privacy in Communication Networks, SecureComm 2023 - Hong Kong Polytechnic University, Hong Kong, Hong Kong
Duration: 19 Oct 202321 Oct 2023
Conference number: 19

Conference

Conference19th International Conference on Security and Privacy in Communication Networks, SecureComm 2023
Abbreviated titleSecureComm
Country/TerritoryHong Kong
CityHong Kong
Period19/10/2321/10/23

Keywords

  • Cybersecurity

Fingerprint

Dive into the research topics of 'Understanding and Measuring Inter-Process Code Injection in Windows Malware'. Together they form a unique fingerprint.

Cite this