gExtractor: Automated extraction of malware deception parameters for autonomous cyber deception

Authors

• Mohammed Noraden Alsaleh, Eastern Michigan University
• Jinpeng Wei, University of North Carolina at Charlotte
• Ehab Al-Shaer, University of North Carolina at Charlotte
• Mohiuddin Ahmed, University of North Carolina at Charlotte

Document Type

Book Chapter

Publication Date

2019

Department/School

Information Security and Applied Computing

Publication Title

Autonomous Cyber Deception: Reasoning, Adaptive Planning, and Evaluation of HoneyThings

Abstract

In this chapter, we present a new analytic framework and an implemented tool, called gExtractor, to analyze the malware behavior and automatically extract the deception parameters using symbolic execution in order to enable the automated creation of cyber deception plans. The deception parameters are environmental variables on which attackers depend to discover the target system and reach their goals; yet, they can be reconfigured and/or misrepresented by the defender in the cyber environment. Our gExtractor approach contributes to the scientific and system foundations of reasoning about autonomous cyber deception. Our prototype was developed based on customizing symbolic execution engine for analyzing Microsoft Windows malware. Our analysis of over fifty of recent malware instances shows that gExtractor has successfully identified various critical parameters that are effective for cyber deception.

Comments

M. N. Alsaleh is a faculty member in EMU's School of Information Security and Applied Computing.

Recommended Citation

Alsaleh, M. N., Wei, J., Al-Shaer, E., & Ahmed, M. (2019). gExtractor: Automated extraction of malware deception parameters for autonomous cyber deception. In E. Al-Shaer, J. Wei, K. W. Hamlen, & C. Wang (Eds.), Autonomous cyber deception: Reasoning, adaptive planning, and evaluation of HoneyThings (pp. 185–207). Springer International. https://doi.org/10.1007/978-3-030-02110-8_10