arXiv subjects

Ivica Stipovic

Publications and source records attributed to Ivica Stipovic.

2 recordsLinked to original sources

arXiv2020

Analysis of an Extension Dynamic Name Service -- A discussion on DNS compliance with RFC 6891

Domain Name Service (DNS) resolution is a mechanism that resolves the symbolic names of networked devices to their corresponding Internet Protocol (IP) address. With the emergence of the document that describes an extension to a DNS service definition, it was becoming apparent that DNS implementations will need to comply with some modified DNS behaviour. One such modification is that DNS continues to use the User Datagram Protocol (UDP) to transmit DNS payloads that are longer than 512 bytes. Until the emergence of the Extension DNS (EDNS) specification, DNS servers would switch over from UDP to Transmission Control Protocol (TCP) if the response payload was larger than 512 bytes. With the new EDNS capability, it was required that DNS replies would continue to provide responses as UDP datagrams even though the response was larger than 512 bytes. To the author's best knowledge, there are no academic articles dealing with the assessment of the DNS servers against EDNS specification. This paper examines the level of compatibility for a number of public DNS servers for some popular internet domains. It also explores behaviour of some contemporary DNS implementations such as Microsoft Windows 2012, 2016 and 2019 as well as Linux-based BIND in regards to the EDNS.

cs.NI↗

arXiv2019

Antiforensic techniques deployed by custom developed malware in evading anti-virus detection

Both malware and antivirus detection tools advance in their capabilities. Malware aim is to evade the detection while antivirus is to detect the malware. Over time, the detection techniques evolved from simple static signature matching over antiheuristic analysis to machine learning assisted algorithms. This thesis describes several layers of anti-virus evasion deployed by the malware and conducts the analysis of the evasion success rate. The scientific contribution of this research is in the following techniques the malware used -- the new algorithm for identifying the Windows operating system functions, a new custom developed obfuscation and de-obfuscation routine and the usage of USB and sound devices enumeration in the anti-heuristic detection. The new PE mutation engine facilitates the malware static signature variation. In the next stage of the assessment, anti-virus engines then test the malware evasion capabilities. The locally installed antivirus applications and the two multi-scanner online engines inspect the submitted malware samples. The thesis examines the results and discusses the strengths and weaknesses of each evasion technique.

cs.CR↗