Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “MALWARE”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

System and method for monitoring power consumption to detect malware

A system and method (referred to as the system) detects malware, viruses, and/or malicious activity by generating a direct current source power consumption profile by causing a monitored device to execute a fully automated recurrent software operation. The system receives by an automated detection system, the direct current source power consumption profile generated by an intelligent power sensor and generates by a detection engine, a power security profile that identifies suspicious code by profiling direct current consumed by monitored type devices. The system executes a detection engine remote from the monitored device that identifies an infected device.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Flexible and Adaptive Malware Identification Using Techniques from Biology

The holy grail in cyber analytics is to find new ways to understand the information we already have access to. One way to do that is to characterize the data into reasonable sizes and then leverage any known information to generate new insights. Biologists have been using a similar process for decades. This paper introduces the MLSTONES tool set that was developed by leveraging biology and bioinformatics, high performance computing, and statistical algorithms applied to cyber data and specifically to malware. Furthermore, the paper discusses the tool suite, its applications, and how it compares or can work with other related tools.

Peterson, Elena S.↗
DOE OSTI2015

Controlling Combinatorial Complexity in Software and Malware Behavior Computation

Virtually all software is out of intellectual control in that no one knows its full behavior. Software Behavior Computation (SBC) is a new technology for understanding everything software does. SBC applies the mathematics of denotational semantics implemented by function composition in Functional Trace Tables (FTTs) to compute the behavior of programs, expressed as disjoint cases of conditional concurrent assignments. In some circumstances, combinatorial explosions in the number of cases can occur when calculating the behavior of sequences of multiple branching structures. This paper describes computational methods that avoid combinatorial explosions. The predicates that control branching structures such as ifthenelses can be organized into three categories: 1) Independent, resulting in no behavior case explosion, 2) Coordinated, resulting in two behavior cases, or 3) Goaloriented, with potential exponential growth in the number of cases. Traditional FTT-based behavior computation can be augmented by two additional computational methods, namely, Single-Value Function Abstractions (SVFAs) and, introduced in this paper, Relational Trace Tables (RTTs). These methods can be applied to the three predicate categories to avoid combinatorial growth in behavior cases while maintaining mathematical correctness.

Hyperion system↗
DOE OSTI2021

Malware Analysis Report for SolarWinds.Orion.Core.BusinessLayer.dll

SolarWinds Orion is a software suite designed to provide “single pane of glass” monitoring of network devices and applications. On December 13 2020, FireEye revealed that SolarWinds Orion was the victim of a supply chain attack and that the SolarWinds signed file SolarWinds.Orion.Core.BusinessLayer.dll contained a backdoor. SolarWinds deployed the back-doored patch to customers beginning in March 2020. FireEye first identified this backdoor and labeled it SUNBURST. The backdoor is composed of roughly 4,000 lines1 of lightly obfuscated .NET within the SolarWinds.Orion.Core.BusinessLayer.OrionImprovementBusinessLayer class of the malicious dll. The backdoor’s capabilities include: the ability to detect and potentially disable antivirus and forensics tools, basic command and control via DNS, and more advanced command and control via HTTP.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗