Network Virtualisation: Virtualising Network Traffic in Windows XP for Dynamic Malware Analysis - Couverture souple

Petritsch, Helmut

 
9783836469197: Network Virtualisation: Virtualising Network Traffic in Windows XP for Dynamic Malware Analysis
Couverture souple
ISBN 10 : 3836469197 ISBN 13 : 9783836469197
Editeur : VDM Verlag Dr. Müller, 2008

Synopsis

Could dynamic Malware analysis be more dynamic by assigning network calls an injected result, defined by the analysis process? Yes, but only if the network access was completely virtualised. This book explains how this virtualisation could be achieved. It starts with an instruction of dynamic Malware analysis and the usage of sockets in the Windows operating system. By using Qemu and TTAnalyze (a tool for dynamic Malware analysis), it describes how network access could be virtualised, so that system calls relating to sockets (and therefore accessing the network) are intercepted at the system call gate, then manipulated and imitated for a dynamic analysis. The book also defines the most important synchronisation techniques of multi-threaded applications for their (network) activities. The reader will gain a thorough understanding, of how high level functions of the Winsock library are executed with the aim of system calls.

Les informations fournies dans la section « Synopsis » peuvent faire référence à une autre édition de ce titre.

Présentation de l'éditeur

Could dynamic Malware analysis be more dynamic by assigning network calls an injected result, defined by the analysis process? Yes, but only if the network access was completely virtualised. This book explains how this virtualisation could be achieved. It starts with an instruction of dynamic Malware analysis and the usage of sockets in the Windows operating system. By using Qemu and TTAnalyze (a tool for dynamic Malware analysis), it describes how network access could be virtualised, so that system calls relating to sockets (and therefore accessing the network) are intercepted at the system call gate, then manipulated and imitated for a dynamic analysis. The book also defines the most important synchronisation techniques of multi-threaded applications for their (network) activities. The reader will gain a thorough understanding, of how high level functions of the Winsock library are executed with the aim of system calls.

Biographie de l'auteur

was born in 1981 in Vienna. After being educated as interior Designer he studied information economics at the Vienna University of Technology. During this period, he grew significantly more interested in more technical aspects of informatics, especially security. He completed his studies with the work covered in this book.

Les informations fournies dans la section « A propos du livre » peuvent faire référence à une autre édition de ce titre.

Éditeur
VDM Verlag Dr. Müller
Date d'édition
2008
Langue
anglais
ISBN 10 
3836469197
ISBN 13 
9783836469197
Reliure
Broché
Nombre de pages
92
Coordonnées du fabricant
non disponible
Personne responsable
Buchpark GmbH
gpsr@buchpark.de

Krügerweg 1
Trebbin
Brandenburg
14959
Allemagne