CAREER: GLEAN: Gearing Rapid Malware Forensics Toward Holistic Mobile Botnet Takedown

Georgia Tech Research Corporation, Atlanta GA

Investigators

Abstract

This award is funded in whole or in part under the American Rescue Plan Act of 2021 (Public Law 117-2). This research benefits national security by advancing science in cyber forensics and malicious software (malware) prevention. Cybercriminals construct massive networks of malware running on infected victim devices that connect to command-and-control servers online. For decades, law enforcement and commercial entities have attempted to take down these globally distributed malware networks with mixed success. This research develops an automated approach to holistic take down such type of malware: both monitoring and disabling their command-and-control servers as well as remediating or removing the malware from the victim’s devices. This approach puts malware operators at a disadvantage (they must reinfect victim’s devices), thus protecting users and organizations. The output of this research, including software, demo videos, and scholarly publications, is being made freely available to the public to empower future research in this area. Discoveries from this project are being transitioned into workforce development activities and educational materials that introduce students to current and emerging cyber-attack investigation techniques. This work proposes that takedown attempts must not only remediate command-and-control (C&C) servers but also disable or remove frontend bots from infected devices, effectively eliminating the chances for a botnet revival. The investigator uses code reflection for C&C payload distribution, a popular trend in bot design that enabled many botnets to survive takedowns. This research is developing GLEAN, a program-analysis-centric pipeline combining automated malware forensics techniques toward holistic remediation of frontend bots and command and control backends. First, GLEAN identifies network behaviors, capabilities, and code reflection routines in the malware sample. Next, GLEAN performs covert monitoring of the C&C server via protocol identification to establish an effective strategy for their takedown. Finally, GLEAN enables the automated generation of a customized remediation payload, by examining the malware’s code reflection routines, capable of disabling the bot or alerting the infected-device’s user. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.