Communications of the ACM
Frankenstein Programmers Test a Cybersecurity Monster
Credit: J.R. Williams
In order to catch a thief, you have to think like one.
UT Dallas computer scientists are trying to stay one step ahead of cyber attackers by creating their own monster. Their monster can cloak itself as it steals and reconfigures information in a computer program.
In part because of the potentially destructive nature of their technology, creators have named this software system Frankenstein, after the monster-creating scientist in author Mary Shelley's novel, Frankenstein; or The Modern Prometheus.
"Shelley's story is an example of a horror that can result from science, and similarly, we intend our creation as a warning that we need better detections for these types of intrusions," says Kevin Hamlen, associate professor of computer science at UT Dallas who created the software, along with his doctoral student Vishwath Mohan. "Criminals may already know how to create this kind of software, so we examined the science behind the danger this represents, in hopes of creating counter measures."
Frankenstein is not a computer virus, which is a program that can multiply and take over other machines. But, it could be used in cyber warfare to provide cover for a virus or another type of malicious software, or malware.
In order to avoid antivirus software, malware typically mutates every time it copies itself onto another machine. Antivirus software figures out the pattern of change and continues to scan for sequences of code that are known to be suspicious.
Frankenstein evades this scanning mechanism. It takes code from programs already on a computer and repurposes it, stringing it together to accomplish the malware's malicious task with new instructions.
"We wanted to build something that learns as it propagates," Hamlen says. "Frankenstein takes from what is already there and reinvents itself."
"Just as Shelley's monster was stitched from body parts, our Frankenstein also stitches software from original program parts, so no red flags are raised," he says. "It looks completely different, but its code is consistent with something normal."
Hamlen says Frankenstein could be used to aid government counterterrorism efforts by providing cover for infiltration of terrorist computer networks. Hamlen is part of the Cyber Security Research and Education Center in the Erik Jonsson School of Engineering and Computer Science.
The UT Dallas research is the first published example describing this type of stealth technology, Hamlen says.
"As a proof-of-concept, we tested Frankenstein on some simple algorithms that are completely benign," Hamlen says. "We did not create damage to anyone's systems."
The next step, he says, is to create more complex versions of the software.
Frankenstein was described in a paper, "Frankenstein: Stitching Malware from Benign Binaries," published online in conjunction with a presentation at a recent 6th USENIX Workshop on Offensive Technologies.
The research was supported by the U.S. National Science Foundation and the U.S. Air Force Office of Scientific Research.
No entries found