BEGIN:VCALENDAR VERSION:2.0 X-WR-CALNAME:EventsCalendar PRODID:-//hacksw/handcal//NONSGML v1.0//EN CALSCALE:GREGORIAN BEGIN:VTIMEZONE TZID:America/New_York LAST-MODIFIED:20240422T053451Z TZURL:https://www.tzurl.org/zoneinfo-outlook/America/New_York X-LIC-LOCATION:America/New_York BEGIN:DAYLIGHT TZNAME:EDT TZOFFSETFROM:-0500 TZOFFSETTO:-0400 DTSTART:19700308T020000 RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU END:DAYLIGHT BEGIN:STANDARD TZNAME:EST TZOFFSETFROM:-0400 TZOFFSETTO:-0500 DTSTART:19701101T020000 RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU END:STANDARD END:VTIMEZONE BEGIN:VEVENT CATEGORIES:College of Engineering,Thesis/Dissertations DESCRIPTION:Thesis Advisor:  Dr. Gokhan Kul - CIS/DSC, University of Massa chusetts, Dartmouth Committee Members: Dr. Adnan El-Nasan, CIS/DSC, Univ ersity of Massachusetts, Dartmouth Dr. Asif Kamal Turzo, CIS/DSC, Universi ty of Massachusetts, Dartmouth Abstract Traditional malware reverse engin eering relies heavily on static analysis, often producing decompiled pseud o-source that lacks meaningful semantic information and behavioral context , particularly for packed or obfuscated binaries. Although retrieval-augme nted generation (RAG) has shown promise for enhancing binary analysis, exi sting approaches primarily retrieve static code artifacts and rarely integ rate complementary evidence collected before and after payload recovery an d during runtime execution. To address these limitations, prior work propo sed an autonomous multimodal hybrid RAG framework for reverse engineering packed and obfuscated malware. The broader proposed framework is designed to integrate static artifacts before and after payload recovery, as well a s runtime execution evidence from the target binary to support semantic re construction and binary-level behavioral analysis.This work implements the first stage of the previously proposed autonomous multimodal hybrid RAG f ramework. This thesis presents the design, implementation, and evaluation of a custom isolated virtual malware laboratory and an automated artifact generation pipeline that integrates static analysis, controlled execution, and automated payload recovery for packed and obfuscated malware. The pro posed system enables the systematic collection of static artifacts before and after payload recovery, alongside complementary dynamic artifacts coll ected during controlled execution. Automated payload recovery techniques a re implemented for UPX-packed payloads with anti-static-unpacking modifica tions, as well as Hyperion-encrypted payloads, allowing the pipeline to ge nerate decompiled code and other static artifacts relevant to the actual m alware logic. The proposed system is evaluated across three dimensions: la boratory security, artifact generation, and payload recovery. Laboratory s ecurity is evaluated through systematic validation of network isolation, i nter-VM communication restrictions, and access-control policies, while env ironmental realism is examined as an additional design consideration. Arti fact generation is evaluated in terms of correctness and completeness. Pay load recovery is evaluated through reconstruction success, executable vali dity, original entry point (OEP) correctness, and comparisons of static ar tifacts generated from the unobfuscated, obfuscated, and recovered executa bles, including decompiled code, disassembly, and control-flow graphs (CFG s). Together, these contributions establish a controlled and automated fou ndation for generating heterogeneous malware reverse-engineering artifacts to support future retrieval-augmented semantic reconstruction and binary- level behavioral analysis.For further information please contact Dr. Gokha n Kul at gkul@umassd.edu.  All CIS MS students are encouraged to attend.  \nEvent page: https://www.umassd.edu/events/cms/12-7-26-design-and-evalu ation-of-a-custom-isolated-virtual-malware-lab.php\nEvent link: https://um assd.zoom.us/j/97089567317?pwd=p2ZghinLHjhbCp9bhueDAT2kmidSaW.1 X-ALT-DESC;FMTTYPE=text/html:

Thesis Advisor:  Dr. Gokhan Ku l - CIS/DSC\, University of Massachusetts\, Dartmouth
 
Committee M embers:

\n\n

Abstract

\n

Traditional malware reverse engineering relies heavily on static analysis\, often prod ucing decompiled pseudo-source that lacks meaningful semantic information and behavioral context\, particularly for packed or obfuscated binaries. A lthough retrieval-augmented generation (RAG) has shown promise for enhanci ng binary analysis\, existing approaches primarily retrieve static code ar tifacts and rarely integrate complementary evidence collected before and a fter payload recovery and during runtime execution. To address these limit ations\, prior work proposed an autonomous multimodal hybrid RAG framework for reverse engineering packed and obfuscated malware. The broader propos ed framework is designed to integrate static artifacts before and after pa yload recovery\, as well as runtime execution evidence from the target bin ary to support semantic reconstruction and binary-level behavioral analysi s.
This work implements the first stage of the previously proposed auto nomous multimodal hybrid RAG framework. This thesis presents the design\, implementation\, and evaluation of a custom isolated virtual malware labor atory and an automated artifact generation pipeline that integrates static analysis\, controlled execution\, and automated payload recovery for pack ed and obfuscated malware. The proposed system enables the systematic coll ection of static artifacts before and after payload recovery\, alongside c omplementary dynamic artifacts collected during controlled execution. Auto mated payload recovery techniques are implemented for UPX-packed payloads with anti-static-unpacking modifications\, as well as Hyperion-encrypted p ayloads\, allowing the pipeline to generate decompiled code and other stat ic artifacts relevant to the actual malware logic.

\n

The proposed sy stem is evaluated across three dimensions: laboratory security\, artifact generation\, and payload recovery. Laboratory security is evaluated throug h systematic validation of network isolation\, inter-VM communication rest rictions\, and access-control policies\, while environmental realism is ex amined as an additional design consideration. Artifact generation is evalu ated in terms of correctness and completeness. Payload recovery is evaluat ed through reconstruction success\, executable validity\, original entry p oint (OEP) correctness\, and comparisons of static artifacts generated fro m the unobfuscated\, obfuscated\, and recovered executables\, including de compiled code\, disassembly\, and control-flow graphs (CFGs).

\n

Toge ther\, these contributions establish a controlled and automated foundation for generating heterogeneous malware reverse-engineering artifacts to sup port future retrieval-augmented semantic reconstruction and binary-level b ehavioral analysis.
For further information please contact Dr. Gokhan K ul at gkul@umassd.edu.  All CIS MS students are encouraged to attend.  < /p>

Event page: https://www .umassd.edu/events/cms/12-7-26-design-and-evaluation-of-a-custom-isolated- virtual-malware-lab.php
Event link: https://umassd.zoom.u s/j/97089567317?pwd=p2ZghinLHjhbCp9bhueDAT2kmidSaW.1

DTSTAMP:20261112T150134 DTSTART;TZID=America/New_York:20261207T103000 DTEND;TZID=America/New_York:20261207T113000 LOCATION:Zoom Link: https://umassd.zoom.us/j/97089567317?pwd=p2ZghinLHjhbCp 9bhueDAT2kmidSaW.1 SUMMARY;LANGUAGE=en-us:Design and Evaluation of a Custom Isolated Virtual M alware Lab: Automated Artifact Generation and Payload Recovery for Packed and Obfuscated Malware  UID:968f0195dd9c7348b4052f2e910935c5@www.umassd.edu END:VEVENT END:VCALENDAR