ANALYSING OPERATING SYSTEM CONFIGURATIONS
At least in some examples, a non-transitory machine-readable storage medium can be encoded with instructions for analysing an operating system configuration, the instructions executable by a processor of a system, whereby to cause the system to generate a set of malware samples, each malware sample defined by a set of actions forming an attack chain representing a sequence of procedures, execute each of the malware samples on an instance of the operating system configuration to generate a set of logs, and using the set of logs, determine a set of actions detected by an anti-malware process of the operating system configuration.
1 . A non-transitory machine-readable storage medium encoded with instructions for analysing an operating system configuration, the instructions executable by a processor of a system, whereby to cause the system to:
generate a set of malware samples, each malware sample defined by a set of actions forming an attack chain representing a sequence of procedures;
execute each of the malware samples on an instance of the operating system configuration to generate a set of logs; and
using the set of logs, determine a set of actions detected by an anti-malware process of the operating system configuration.
2 . The non-transitory machine-readable storage medium as claimed in claim 1 , further encoded with instructions, whereby to cause the system to:
generate a set of operating system instances, each operating system instance comprising a variant of the operating system.
3 . The non-transitory machine-readable storage medium as claimed in claim 2 , further encoded with instructions, whereby to cause the system to:
execute each of the malware samples on respective clean instances of each of the operating system instances.
4 . The non-transitory machine-readable storage medium as claimed in claim 2 , further encoded with instructions, whereby to cause the system to:
generate at least one operating system instance comprising an antivirus system.
5 . The non-transitory machine-readable storage medium as claimed in claim 2 , further encoded with instructions, whereby to cause the system to:
generate at least some operating system instances with respective different security configurations.
6 . The non-transitory machine-readable storage medium as claimed in claim 1 , further encoded with instructions, whereby to cause the system to:
detect whether a malware sample fully executes on the operating system instance.
7 . An apparatus, comprising:
a processor; and
a data storage system comprising instructions defining a set of procedures;
the processor to:
generate a set of malware samples, each malware sample comprising a sequence of procedures from the set of procedures and forming an attack chain corresponding to a preselected configuration;
apply each malware sample to an instance of an operating system configuration to generate log data comprising output data from at least one of a malware sample and an anti-malware process of the operating system configuration; and
determine, using the log data, a set of actions detected by the anti-malware process of the operating system configuration.
8 . The apparatus as claimed in claim 7 , the processor further to:
generate a set of operating system instances, each operating system instance comprising a variant of the operating system.
9 . The apparatus as claimed in claim 7 , the processor further to:
provide coordination data to respective ones of the procedures of the set of procedures forming the attack chain.
10 . The apparatus as claimed in claim 9 , the processor further to:
instantiate each clean instance of the each of the operating system instances on a virtual machine.
11 . The apparatus as claimed in claim 7 , the processor further to:
generate the operating system instance according to a predefined security configuration.
12 . The apparatus as claimed in claim 7 , the processor further to:
detect an action performed by a malware sample indicating successful execution of the malware sample.
13 . A method for analysing an operating system configuration, the method comprising:
generating a set of malware samples;
execute each malware sample on a clean instantiation of operating system configured according to a security configuration; and
generate log data representing detection of an action performed by a malware sample on the operating system instance.
14 . The method as claimed in claim 13 , further comprising:
generating a malware sample using a set of techniques configured to form an attack chain configured according to an attack specification.
15 . The method as claimed in claim 13 , further comprising:
passing coordination data between respective actions forming an attack chain of a malware sample.