Fighting Evasive Malware with DVasion

Malware is a foundational component of cyber crime that enables an attacker to modify the normal operation of a computer or access sensitive, digital information. Despite the extensive research performed to identify such programs, existing schemes fail to detect evasive malware, an increasingly popular class of malware that can alter its behavior at run-time, making it difficult to detect using today’s state of the art malware analysis systems. In this thesis, we present DVasion, a comprehensive strategy that exposes such evasive behavior through a multi-execution technique. DVasion successfully detects behavior that would have been missed by traditional, single-execution approaches, while addressing the limitations of previously proposed multi-execution systems. We demonstrate the accuracy of our system through strong parallels with existing work on evasive malware, as well as uncover the hidden behavior within 167 of 1,000 samples.

Cyclic Pursuit: Symmetry, Reduction and Nonlinear Dynamics

In this dissertation, we explore the use of pursuit interactions as a building block for collective behavior, primarily in the context of constant bearing (CB) cyclic pursuit. Pursuit phenomena are observed throughout the natural environment and also play an important role in technological contexts, such as missile-aircraft encounters and interactions between unmanned vehicles. While pursuit is typically regarded as adversarial, we demonstrate that pursuit interactions within a cyclic pursuit framework give rise to seemingly coordinated group maneuvers. We model a system of agents (e.g. birds, vehicles) as particles tracing out curves in the plane, and illustrate reduction to the shape space of relative positions and velocities. Introducing the CB pursuit strategy and associated pursuit law, we consider the case for which agent i pursues agent i+1 (modulo n) with the CB pursuit law. After deriving closed-loop cyclic pursuit dynamics, we demonstrate asymptotic convergence to an invariant submanifold (corresponding to each agent attaining the CB pursuit strategy), and proceed by analysis of the reduced dynamics restricted to the submanifold. For the general setting, we derive existence conditions for relative equilibria (circling and rectilinear) as well as for system trajectories which preserve the shape of the collective (up to similarity), which we refer to as pure shape equilibria. For two illustrative low-dimensional cases, we provide a more comprehensive analysis, deriving explicit trajectory solutions for the two-particle "mutual pursuit" case, and detailing the stability properties of three-particle relative equilibria and pure shape equilibria. For the three-particle case, we show that a particular choice of CB pursuit parameters gives rise to remarkable almost-periodic trajectories in the physical space. We also extend our study to consider CB pursuit in three dimensions, deriving a feedback law for executing the CB pursuit strategy, and providing a detailed analysis of the two-particle mutual pursuit case. We complete the work by considering evasive strategies to counter the motion camouflage (MC) pursuit law. After demonstrating that a stochastically steering evader is unable to thwart the MC pursuit strategy, we propose a (deterministic) feedback law for the evader and demonstrate the existence of circling equilibria for the closed-loop pursuer-evader dynamics.