MBMAS: A System for Malware Behavior Monitor and Analysis

In this paper, we present MBMAS, a system for malware behavior monitor and analysis. MBMAS executes a malware sample in a controllable environment, monitors the state of system in five aspects including process, file system, registry, port and network, and automatically generates a detailed report. MBMAS provides useful filter mechanism which can only monitor the behaviors of processes created by malware. In this case, we can only capture information we need without losing any important information. MBMAS also provides automatic analysis function to analyze the behaviors of malware from captured information, and output a shortest report only includes behaviors of file creation, file deletion, registry changed and port opened. This report not only can be used by anti-virus software directly, but also can be used by common users who used for eliminating the malware and recovering operating system.