|
|
C Language Source Files Similarity Detection
Rek, Petr ; Kučera, Jiří (referee) ; Matula, Peter (advisor)
This thesis deals with design, implementation and testing of the csim tool, which compares two C source files by their similarity. The primary purpose of this tool is testing of a decompiler developed by AVG Technologies s.r.o. Testing is based on comparing abstract syntax trees of the original and decompiled source files. The reader is introduced to the basics of reverse engineering, especially reverse engineering of a binary file into a high-level programming language source file. The process of compiling followed by decompiling of a file is described along with its effect on reverse engineering. The LLVM project and the Clang compiler is introduced to the reader, since its libraries are the foundation upon which the csim tool is built.
|
|
|
Malware Detection Using DNS Traffic Analysis
Daniš, Daniel ; Ovšonka, Daniel (referee) ; Kováčik, Michal (advisor)
This master thesis deals with the design and implementation of a tool for malware detection using DNS traffic analysis. Text of the thesis is divided into theoretical and practical part. In theoretical part the reader will be acknowledged with the domain of malware and botnet detection. Consequently, various options and methods of malware detection will be described. Practical part of the thesis contains description of malware detection tool architecture as well as key aspects of its implementation. Moreover, the emphasis is being placed on testing and experiments. The result of the thesis is a tool, written in python, for malware detection using DNS traffic analysis, that uses a combination of several methods of detection.
|
|
|
Java Byte Code Emulator Suitable for Malware Detection and Analysis
Kubernát, Tomáš ; Rogalewicz, Adam (referee) ; Drahanský, Martin (advisor)
The goal of this thesis is to create a virtual machine that emulates a running programs written in Java programing language, which would be suitable for malware analysis and detection. The emulator is able to detect arguments of exploitable methods from Java standard classes, the order of calling these exploitable methods and also execution the test application. Overall functionality was tested on appropriate examples in which held its own measurements. At the end of the paper we describe testing of the emulator, which also contains tables and graphs for better results visualization.
|
|
|
Identification and characterization of malicious behavior in behavioral graphs
Varga, Adam ; Burget, Radim (referee) ; Hajný, Jan (advisor)
Za posledné roky je zaznamenaný nárast prác zahrňujúcich komplexnú detekciu malvéru. Pre potreby zachytenia správania je často vhodné pouziť formát grafov. To je prípad antivírusového programu Avast, ktorého behaviorálny štít deteguje škodlivé správanie a ukladá ich vo forme grafov. Keďže sa jedná o proprietárne riešenie a Avast antivirus pracuje s vlastnou sadou charakterizovaného správania bolo nutné navrhnúť vlastnú metódu detekcie, ktorá bude postavená nad týmito grafmi správania. Táto práca analyzuje grafy správania škodlivého softvéru zachytené behavioralnym štítom antivírusového programu Avast pre proces hlbšej detekcie škodlivého softvéru. Detekcia škodlivého správania sa začína analýzou a abstrakciou vzorcov z grafu správania. Izolované vzory môžu efektívnejšie identifikovať dynamicky sa meniaci malware. Grafy správania sú uložené v databáze grafov Neo4j a každý deň sú zachytené tisíce z nich. Cieľom tejto práce bolo navrhnúť algoritmus na identifikáciu správania škodlivého softvéru s dôrazom na rýchlosť skenovania a jasnosť identifikovaných vzorcov správania. Identifikácia škodlivého správania spočíva v nájdení najdôležitejších vlastností natrénovaných klasifikátorov a následnej extrakcie podgrafu pozostávajúceho iba z týchto dôležitých vlastností uzlov a vzťahov medzi nimi. Následne je navrhnuté pravidlo pre hodnotenie extrahovaného podgrafu. Diplomová práca prebehla v spolupráci so spoločnosťou Avast Software s.r.o.
|
|
|
Detection of Security Incidents in Hospital Computer Network
Pisk, Jiří ; Ryšavý, Ondřej (referee) ; Matoušek, Petr (advisor)
This work explores honeypots as an early threat detection system in the production network of Jihlava hospital, analysis of the data collected from those honeypots as well as a comparison of currently available solutions for honeypot deployment. As part of the practical section multiple instances of TPot (an open source honeypot platform) are deployed as well as one instance serving as a monitor for the whole system. This implementation is then tested using automated penetration testing tools and the results used to design and implement automatic alerts to detected incidents.
|
|
|
Detection of Security Incidents in Hospital Computer Network
Pisk, Jiří ; Ryšavý, Ondřej (referee) ; Matoušek, Petr (advisor)
This work explores honeypots as an early threat detection system in the production network of Jihlava hospital, analysis of the data collected from those honeypots as well as a comparison of currently available solutions for honeypot deployment. As part of the practical section multiple instances of TPot (an open source honeypot platform) are deployed as well as one instance serving as a monitor for the whole system. This implementation is then tested using automated penetration testing tools and the results used to design and implement automatic alerts to detected incidents.
|
|
|
Identification and characterization of malicious behavior in behavioral graphs
Varga, Adam ; Burget, Radim (referee) ; Hajný, Jan (advisor)
Za posledné roky je zaznamenaný nárast prác zahrňujúcich komplexnú detekciu malvéru. Pre potreby zachytenia správania je často vhodné pouziť formát grafov. To je prípad antivírusového programu Avast, ktorého behaviorálny štít deteguje škodlivé správanie a ukladá ich vo forme grafov. Keďže sa jedná o proprietárne riešenie a Avast antivirus pracuje s vlastnou sadou charakterizovaného správania bolo nutné navrhnúť vlastnú metódu detekcie, ktorá bude postavená nad týmito grafmi správania. Táto práca analyzuje grafy správania škodlivého softvéru zachytené behavioralnym štítom antivírusového programu Avast pre proces hlbšej detekcie škodlivého softvéru. Detekcia škodlivého správania sa začína analýzou a abstrakciou vzorcov z grafu správania. Izolované vzory môžu efektívnejšie identifikovať dynamicky sa meniaci malware. Grafy správania sú uložené v databáze grafov Neo4j a každý deň sú zachytené tisíce z nich. Cieľom tejto práce bolo navrhnúť algoritmus na identifikáciu správania škodlivého softvéru s dôrazom na rýchlosť skenovania a jasnosť identifikovaných vzorcov správania. Identifikácia škodlivého správania spočíva v nájdení najdôležitejších vlastností natrénovaných klasifikátorov a následnej extrakcie podgrafu pozostávajúceho iba z týchto dôležitých vlastností uzlov a vzťahov medzi nimi. Následne je navrhnuté pravidlo pre hodnotenie extrahovaného podgrafu. Diplomová práca prebehla v spolupráci so spoločnosťou Avast Software s.r.o.
|
|
|
Java Byte Code Emulator Suitable for Malware Detection and Analysis
Kubernát, Tomáš ; Rogalewicz, Adam (referee) ; Drahanský, Martin (advisor)
The goal of this thesis is to create a virtual machine that emulates a running programs written in Java programing language, which would be suitable for malware analysis and detection. The emulator is able to detect arguments of exploitable methods from Java standard classes, the order of calling these exploitable methods and also execution the test application. Overall functionality was tested on appropriate examples in which held its own measurements. At the end of the paper we describe testing of the emulator, which also contains tables and graphs for better results visualization.
|
|
|
Aplikace umělých neuronových sítí pro detekci malware v HTTPS komunikaci
Bodnár, Jan ; Lokoč, Jakub (advisor) ; Somol, Petr (referee)
A huge proportion of modern malicious software uses Internet connec- tions. Therefore, it is possible to detect infected computers by inspecting network activity. Since attackers hide the content of communication by com- municating over encrypted protocols such as HTTPS, communication must be analysed purely on the basis of metadata. Cisco provided us a dataset containing aggregated metadata with additional information as to whether or not each sample contains malicious communication. This work trains neu- ral networks to distinguish between infected and benign samples, comparing different architectures of neural networks and providing a comparison with results achieved by different machine learning methods tried by colleagues. It also seeks to create a mapping which maps samples of communication into a space where different samples of malicious communication created by a sin- gle malware family form clusters. This may make it easier to find different computers infected by a virus with known behaviour, even when the virus cannot be detected by the detection system. 1
|
|
|
C Language Source Files Similarity Detection
Rek, Petr ; Kučera, Jiří (referee) ; Matula, Peter (advisor)
This thesis deals with design, implementation and testing of the csim tool, which compares two C source files by their similarity. The primary purpose of this tool is testing of a decompiler developed by AVG Technologies s.r.o. Testing is based on comparing abstract syntax trees of the original and decompiled source files. The reader is introduced to the basics of reverse engineering, especially reverse engineering of a binary file into a high-level programming language source file. The process of compiling followed by decompiling of a file is described along with its effect on reverse engineering. The LLVM project and the Clang compiler is introduced to the reader, since its libraries are the foundation upon which the csim tool is built.
|
guest ::
