loading
Papers Papers/2022 Papers Papers/2022

Research.Publish.Connect.

Paper

Paper Unlock

Authors: Cédric Herzog ; Valérie Viet Triem Tong ; Pierre Wilke ; Arnaud Van Straaten and Jean-Louis Lanet

Affiliation: Inria, CentraleSupélec, Univ. Rennes, CNRS, IRISA, Rennes, France

Keyword(s): Antivirus, Evasion, Windows Malware, Windows API.

Abstract: The perpetual opposition between antiviruses and malware leads both parties to evolve continuously. On the one hand, antiviruses put in place solutions that are more and more sophisticated and propose more complex detection techniques in addition to the classic signature analysis. This sophistication leads antiviruses to leave more traces of their presence on the machine they protect. To remain undetected as long as possible, malware can avoid executing within such environments by hunting down the modifications left by the antiviruses. This paper aims at determining the possibilities for malware to detect the antiviruses and then evaluating the efficiency of these techniques on a panel of antiviruses that are the most used nowadays. We then collect samples showing this kind of behavior and propose to evaluate a countermeasure that creates false artifacts, thus forcing malware to evade.

CC BY-NC-ND 4.0

Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 18.221.187.121

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Herzog, C.; Tong, V.; Wilke, P.; Van Straaten, A. and Lanet, J. (2020). Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures. In Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - SECRYPT; ISBN 978-989-758-446-6; ISSN 2184-7711, SciTePress, pages 302-309. DOI: 10.5220/0009816703020309

@conference{secrypt20,
author={Cédric Herzog. and Valérie Viet Triem Tong. and Pierre Wilke. and Arnaud {Van Straaten}. and Jean{-}Louis Lanet.},
title={Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures},
booktitle={Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - SECRYPT},
year={2020},
pages={302-309},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0009816703020309},
isbn={978-989-758-446-6},
issn={2184-7711},
}

TY - CONF

JO - Proceedings of the 17th International Joint Conference on e-Business and Telecommunications - SECRYPT
TI - Evasive Windows Malware: Impact on Antiviruses and Possible Countermeasures
SN - 978-989-758-446-6
IS - 2184-7711
AU - Herzog, C.
AU - Tong, V.
AU - Wilke, P.
AU - Van Straaten, A.
AU - Lanet, J.
PY - 2020
SP - 302
EP - 309
DO - 10.5220/0009816703020309
PB - SciTePress

- Science and Technology Publications, Lda.
RESOURCES

Proceedings

Papers

Authors

Ontology

CONTACTS

Science and Technology Publications, Lda
Avenida de S. Francisco Xavier, Lote 7 Cv. C,
2900-616 Setúbal, Portugal.

Phone: +351 265 520 185 (National fixed network call)
Fax: +351 265 520 186
Email: info@scitepress.org

EXTERNAL LINKS

PRIMORIS

INSTICC

SCITEVENTS

CROSSREF

PROCEEDINGS SUBMITTED FOR INDEXATION BY:

dblp

Ei Compendex

SCOPUS

Semantic Scholar

Google Scholar

Microsoft Academic