Network Virtualisation

Could dynamic Malware analysis be more dynamic byassigning network calls an injected result, definedby the analysis process? Yes, but only if thenetwork access was completely virtualised. This bookexplains how this virtualisation could be achieved.It starts with an instruction of dynamic Malwareanalysis and the usage of sockets in the Windowsoperating system. By using Qemu and TTAnalyze (atool for dynamic Malware analysis), it describes hownetwork access could be virtualised, so that systemcalls relating to sockets (and therefore accessingthe network) are intercepted at the system callgate, then manipulated and imitated for a dynamicanalysis. The book also defines the most importantsynchronisation techniques of multi-threadedapplications for their (network) activities. Thereader will gain a thorough understanding, of howhigh level functions of the Winsock library areexecuted with the aim of system calls.

Autorentext

was born in 1981 in Vienna. After being educated as interior Designer he studied information economics at the Vienna University of Technology. During this period, he grew significantly more interested in more technical aspects of informatics, especially security. He completed his studies with the work covered in this book.