Paper Abstract and Keywords |
Presentation |
2021-01-21 17:50
Reproduction of Malware Behavior by Using Windows API Call Logs
-- Support for Major Win32 APIs and State Restoration After the Reproduction -- Naoya Matsuda, Youji Fukuta (Kindai Univ.), Masanori Hirotomo (Saga Univ.), Yoshiaki Shiraishi (Kobe Univ.) ICM2020-47 LOIS2020-35 |
Abstract |
(in Japanese) |
(See Japanese page) |
(in English) |
The authors have been developing a prototype tool to reproduce of malware behavior by using Windows API call logs so that we can verify how it interacts with other terminals and systems during an incident response. In this study, we examine the status of support for the major Win32 APIs and state restoration to revert the effects of various Win32 API calls after reproduction with the tool. |
Keyword |
(in Japanese) |
(See Japanese page) |
(in English) |
Incident response / Malicious software / Reproduction / Win32 API call logs / / / / |
Reference Info. |
IEICE Tech. Rep., vol. 120, no. 324, LOIS2020-35, pp. 75-80, Jan. 2021. |
Paper # |
LOIS2020-35 |
Date of Issue |
2021-01-14 (ICM, LOIS) |
ISSN |
Online edition: ISSN 2432-6380 |
Copyright and reproduction |
All rights are reserved and no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher. Notwithstanding, instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. (License No.: 10GA0019/12GB0052/13GB0056/17GB0034/18GB0034) |
Download PDF |
ICM2020-47 LOIS2020-35 |
Conference Information |
Committee |
ICM LOIS |
Conference Date |
2021-01-21 - 2021-01-22 |
Place (in Japanese) |
(See Japanese page) |
Place (in English) |
Online |
Topics (in Japanese) |
(See Japanese page) |
Topics (in English) |
Practical Use of Lifelog, Office Information System, Business Management, etc. |
Paper Information |
Registration To |
LOIS |
Conference Code |
2021-01-ICM-LOIS |
Language |
Japanese |
Title (in Japanese) |
(See Japanese page) |
Sub Title (in Japanese) |
(See Japanese page) |
Title (in English) |
Reproduction of Malware Behavior by Using Windows API Call Logs |
Sub Title (in English) |
Support for Major Win32 APIs and State Restoration After the Reproduction |
Keyword(1) |
Incident response |
Keyword(2) |
Malicious software |
Keyword(3) |
Reproduction |
Keyword(4) |
Win32 API call logs |
Keyword(5) |
|
Keyword(6) |
|
Keyword(7) |
|
Keyword(8) |
|
1st Author's Name |
Naoya Matsuda |
1st Author's Affiliation |
Kindai University (Kindai Univ.) |
2nd Author's Name |
Youji Fukuta |
2nd Author's Affiliation |
Kindai University (Kindai Univ.) |
3rd Author's Name |
Masanori Hirotomo |
3rd Author's Affiliation |
Saga University (Saga Univ.) |
4th Author's Name |
Yoshiaki Shiraishi |
4th Author's Affiliation |
Kobe University (Kobe Univ.) |
5th Author's Name |
|
5th Author's Affiliation |
() |
6th Author's Name |
|
6th Author's Affiliation |
() |
7th Author's Name |
|
7th Author's Affiliation |
() |
8th Author's Name |
|
8th Author's Affiliation |
() |
9th Author's Name |
|
9th Author's Affiliation |
() |
10th Author's Name |
|
10th Author's Affiliation |
() |
11th Author's Name |
|
11th Author's Affiliation |
() |
12th Author's Name |
|
12th Author's Affiliation |
() |
13th Author's Name |
|
13th Author's Affiliation |
() |
14th Author's Name |
|
14th Author's Affiliation |
() |
15th Author's Name |
|
15th Author's Affiliation |
() |
16th Author's Name |
|
16th Author's Affiliation |
() |
17th Author's Name |
|
17th Author's Affiliation |
() |
18th Author's Name |
|
18th Author's Affiliation |
() |
19th Author's Name |
|
19th Author's Affiliation |
() |
20th Author's Name |
|
20th Author's Affiliation |
() |
Speaker |
Author-1 |
Date Time |
2021-01-21 17:50:00 |
Presentation Time |
20 minutes |
Registration for |
LOIS |
Paper # |
ICM2020-47, LOIS2020-35 |
Volume (vol) |
vol.120 |
Number (no) |
no.323(ICM), no.324(LOIS) |
Page |
pp.75-80 |
#Pages |
6 |
Date of Issue |
2021-01-14 (ICM, LOIS) |
|