When it comes to the fight against malware, a network’s capabilities is determined by its tools. To properly identify, analyze, and contain malware, you need to have the right software. Through this post, we will explore the tools that are needed for malware analysis — in addition to the key factors to consider when selecting each type of tool. Critical to this is an understanding of how malware works and the challenges facing businesses today.
Sandbox Environments
Malicious programs often seek to make dramatic changes to the user’s environment. Files may be deleted, altered, or replaced — and registry settings may be added, modified, or removed. There are certain behaviors and actions that are considered to be hallmarks of malicious programs, but if a malicious program already has made these changes, the system could experience damage even if the program is detected. Sandbox environments mitigate this threat.
A sandbox creates a separate walled off environment in the form of a virtualized system. There, the program can be launched (“detonated”) without fear of impacting the rest of the network. Though the program may take actions within the sandbox, these actions aren’t going to impact the larger network environment. If the program doesn’t complete any malicious actions in its sandbox, it may be allowed into the larger environment, such as being delivered via the email message to which it originally was attached.
Unfortunately, new malicious programs can detect when they are being run in many, but not all, sandbox environments. They can tell that they aren’t impacting a network as a whole, by testing the features of the environment that they are in. In order to defeat this, you need a full system emulation sandbox. This replicates everything, down to the hardware that would be attached to the host system being targeted.
Analysts occasionally dismiss sandboxes as a commodity product — a solution that is everywhere, but not valuable. Though sandboxes are only one part of a network’s security infrastructure they are still an important one, and unlike other commodity products that are essentially identical, there is significant variation across sandboxes in terms of effectiveness in detecting malware that’s actively trying to avoid being detected. The least effective sandboxes rely on signatures. The most effective ones rely on full system emulation to detect the actual behaviors engineered into the malware code.
Behavior Analysis Tools
In prior years, malware was often identified by comparison. Directories of the signatures of known malicious programs were consulted whenever a program was installed or run. If the program’s signature wasn’t in the directory, it was deemed to be safe. Though this was a rudimentary method of analysis, it was also the most feasible, and very fast and inexpensive. New malware was constantly being identified and added to these directories — and malware wasn’t being released as frequently as it is today.
Not only are new malicious programs being released more often today, but advanced malicious programs are now able to change themselves on-the-fly, creating new signatures to avoid detection. This makes comparing them to a directory much harder, though not impossible. Directories are still able to use some features of the program to identify it, but it is getting harder. The preferred solution is behavioral analysis tools.
Behavioral analysis tools don’t rely on signatures. Instead, they identify what the tool is attempting to do and then warn the user that the behavior appears to be malicious. An example might be a program that appears to be altering registry settings in a dangerous way, or changing security settings, or looking for another system in which to migrate. The malware analysis tool will prompt the user that the program is behaving in a dangerous manner. It is then up to the user to determine whether the program could be malicious.
Sophisticated, modern tools use artificial intelligence to identify patterns that human analyzers may not see, such as files being rapidly modified, or the system itself being altered. Products such as Lastline Analyst can identify these behaviors before the program is even run, through code inspection and analysis. Other solutions may just “roll back” the changes detected once the program has been deemed to be malicious.
Reverse Engineering and Debugging Tools
Sometimes a malicious program is sophisticated enough that even the best-automated analysis tools are unable to detect them or understand precisely what they do. In this case, malicious programs can be reverse engineered through the use of a debugger, disassembler, and other specialized tools. The content of the malicious program is traced back to its initial programming, which can then be inspected for malicious actions.
Reverse engineering is a very high-level method of analysis. It is prohibitively resource-intensive and time-consuming, and so is not generally part of the automated processes that protect a network. Instead, it is targeted towards identifying potential flaws or malicious behaviors in specific programs and files, including suspect files being seen for the first time. A reverse engineering solution also might be used for an open source program that the business is thinking of deploying in order to ensure that it is not malicious.
Network Traffic Analysis
As with behavioral analysis, network traffic analysis relies on identifying malicious programs through their actions, rather than through identifying characteristics of the program itself. Network traffic analysis relies upon the fact that a malicious program is going to generate activity across a network, including the traffic originating from the network, coming into the network, and traversing laterally across a network. Network traffic analysis might be able to identify large numbers of files being uploaded or downloaded, files being moved, or files being encrypted at rates that are unusual.
Like behavioral analysis, network traffic analysis can “learn” from the network itself, to better identify outlying behavior. A network may have peak usage times and times of relative quiet; a network analysis program is going to be able to identify these times and behaviors that diverge from routine. Though programs may be modified so that they are not easily identifiable, their actions are still going to be visible.
What makes network traffic analysis technology even more effective is when it is married with malware behavior analysis. With such a combination of capabilities, network traffic that may only appear to be anomalous can be compared to known malware behaviors. A match will make it quite clear that the anomalous activity is indeed malicious. After all, not all anomalies are malicious, and not all malware activity is anomalous. So the combination of both technologies is ideal.
Responding to Threats
It’s not enough to just analyze threats. Threats also need to be responded to. The best malware analysis tools can both detect and remediate threats. Sandboxing tools will quarantine threats and can rollback changes that malicious programs have made. Behavioral analysis and network traffic analysis suites can pare down to the malicious programs themselves, quarantining them until further review, inform perimeter defenses against further attack, and identify what systems have been infected to inform complete remediation. Ideally, malicious programs should be able to detect threats quickly, act to isolate the threats, and be able to reverse the damage that has been caused by the threat.
When it comes to malware analysis tools, response time is the most important factor. The faster an organization is able to respond, the more of the damage the organization is able to preempt. All of the above tools may have different response times.
By using a combination of these malware analysis tools, you can create a comprehensive malware detection suite. This is where advanced threat detection solutions such as Lastline are highly effective. Lastline provides the most sophisticated malware detection and network traffic analytics technologies available. Test drive them today by scheduling a demo.
The post Best Malware Analysis Tools For Detecting and Responding to Threats appeared first on Lastline.
Article Link: https://www.lastline.com/blog/best-malware-analysis-tools-for-detecting-and-responding-to-threats/