University of Twente Student Theses
Behavioural analysis of program intent using data origins, influence and context
Verkleij, Jelmer (2017) Behavioural analysis of program intent using data origins, influence and context.
|
PDF
2MB |
| Abstract: | This thesis introduces a method for modelling PHP script behaviour as a graph, as well as a method for defining behavioural patterns and searching for those patterns in these graph representations. By analysing what runtime behaviour can be used for distinguishing malware from legitimate code, and looking at similar techniques in related fields, a method is developed based on the aforementioned modelling technique for tracking relevant actions taken by the interpreter during script execution and using that to determine whether the actions could be considered to have harmful effects. After creating a relevant set of heuristics, the effectiveness of the instrumentation is put to the test by comparing its performance on datasets of both malicious and legitimate code. The proposed method proves to be highly accurate and effective, and it has better detection rates than all other scanning techniques currently on the market. There are however some concerns about the instrumentation's performance and stability. Based on the testing results, we also provide several recommendations for further feature expansion and future applications of similar methods for detecting particular development patterns, errors or vulnerabilities in script behaviour. |
| Item Type: | Essay (Master) |
| Clients: | Patchman B.V., Enschede, Netherlands |
| Faculty: | EEMCS: Electrical Engineering, Mathematics and Computer Science |
| Subject: | 54 computer science |
| Programme: | Embedded Systems MSc (60331) |
| Link to this item: | https://purl.utwente.nl/essays/72965 |
| Export this item as: | BibTeX EndNote HTML Citation Reference Manager |
Show download statistics for this publication
Show download statistics for this publicationRepository Staff Only: item control page