Active malware analysis

Abstract

Dynamic Malware analysis is an extremely integral component of Malware Analysis. Dynamic analysis helps to provide an effective approach to analysing malware by executing it in an isolated environment. However, malware authors are constantly trying to evolve their malware and develop techniques to evade analysis and detection, leading to a constant cat-and-mouse game between attackers and defenders. The solution I proposed in this paper would be to utilize a kernel-mode monitor as user-mode malware would not be able to detect these tools. As a result, these tools can remain hidden. Through this paper, I will discuss the feasibility of developing a kernel-mode malware analysis tool to effectively detect malware in real-time and provide a quick and robust response to these malware.