scholarly journals A Dynamic Taint Analysis Framework Based on Entity Equipment

IEEE Access ◽  
2019 ◽  
Vol 7 ◽  
pp. 186308-186318
Author(s):  
Yuzhu Ren ◽  
Weiyu Dong ◽  
Jian Lin ◽  
Xinliang Miao
Keyword(s):  
Analysis Framework ◽  
Taint Analysis

scholarly journals WTA: A Static Taint Analysis Framework for PHP Webshell

2021 ◽  
Vol 11 (16) ◽  
pp. 7763
Author(s):  
Jiazhen Zhao ◽  
Yuliang Lu ◽  
Xin Wang ◽  
Kailong Zhu ◽  
Lu Yu
Keyword(s):  
Pattern Matching ◽  
Detection Method ◽  
Benchmark Dataset ◽  
Detection Methods ◽  
Prototype System ◽  
Analysis Framework ◽  
Taint Analysis ◽  
Interprocedural Analysis ◽  
Internal Network

Webshells are a malicious scripts that can remotely control a webserver to execute arbitrary commands, steal sensitive files, and further invade the internal network. Existing webshell detection methods, such as using pattern matching for webshell detection, can be easily bypassed by attackers using the file include and user-defined functions. Furthermore, detecting unknown webshells has always been a problem in the field of webshell detection. In this paper, we propose a static webshell detection method based on taint analysis, which realizes accurate taint analysis based on ZendVM. We first converted the PHP code into Opline sequences, analyzed the Opline sequences in order, and marked the externally imported taint source. Then, the propagation of the taint variables was tracked, and the interprocedural analysis of the taint variables was performed. Finally, considering the dangerous functions’ call and the referencing of the taint variables at the point of the taint sink, we completed the webshell judgment. Based on this method, we constructed a taint analysis prototype system named WTA and evaluated it with a benchmark dataset by comparing its performance with popular webshell detection tools. The results showed that our method supports interprocedural analysis and has the ability to detect unknown webshells and that WTA’s performance surpasses well-known webshell detection tools such as D-shield, SHELLPUB, WebshellKiller, CloudWalker, ClamAV, LoKi, and findbot.pl.

scholarly journals TaintMan: An ART-Compatible Dynamic Taint Analysis Framework on Unmodified and Non-Rooted Android Devices

2020 ◽  
Vol 17 (1) ◽  
pp. 209-222 ◽  
Author(s):  
Wei You ◽  
Bin Liang ◽  
Wenchang Shi ◽  
Peng Wang ◽  
Xiangyu Zhang
Keyword(s):  
Analysis Framework ◽  
Taint Analysis

Dytaint: The implementation of a novel lightweight 3-state dynamic taint analysis framework for x86 binary programs

2015 ◽  
Vol 52 ◽  
pp. 51-69 ◽  
Author(s):  
Erzhou Zhu ◽  
Feng Liu ◽  
Zuo Wang ◽  
Alei Liang ◽  
Yiwen Zhang ◽  
...  
Keyword(s):  
Analysis Framework ◽  
Taint Analysis ◽  
State Dynamic ◽  
Binary Programs

Constructing a Hybrid Taint Analysis Framework for Diagnosing Attacks on Binary Programs

2014 ◽  
Vol 9 (3) ◽  
Author(s):  
Erzhou Zhu ◽  
Xuejun Li ◽  
Feng Liu ◽  
Xuejian Li ◽  
Zhujuan Ma
Keyword(s):  
Analysis Framework ◽  
Taint Analysis ◽  
Binary Programs
Sign in / Sign up

Export Citation Format

Share Document