Frankenstein Programmers Test a Cybersecurity Monster

In order to catch a thief, you have to think like one.

UT Dallas computer scientists are trying to stay one step ahead of cyber attackers by creating their own monster. Their monster can cloak itself as it steals and reconfigures information in a computer program.

In part because of the potentially destructive nature of their technology, creators have named this software system Frankenstein, after the monster-creating scientist in author Mary Shelley’s novel, Frankenstein; or The Modern Prometheus.

“Shelley’s story is an example of a horror that can result from science, and similarly, we intend our creation as a warning that we need better detections for these types of intrusions,” said Dr. Kevin Hamlen, associate professor of computer science at UT Dallas who created the software, along with his doctoral student Vishwath Mohan. “Criminals may already know how to create this kind of software, so we examined the science behind the danger this represents, in hopes of creating counter measures.”

Frankenstein is not a computer virus, which is a program that can multiply and take over other machines. But, it could be used in cyber warfare to provide cover for a virus or another type of malware, or malicious software.

In order to avoid antivirus software, malware typically mutates every time it copies itself onto another machine. Antivirus software figures out the pattern of change and continues to scan for sequences of code that are known to be suspicious.

Frankenstein evades this scanning mechanism. It takes code from programs already on a computer and repurposes it, stringing it together to accomplish the malware’s malicious task with new instructions.

“We wanted to build something that learns as it propagates,” Hamlen said. “Frankenstein takes from what is already there and reinvents itself.”

“Just as Shelley’s monster was stitched from body parts, our Frankenstein also stitches software from original program parts, so no red flags are raised,” he said. “It looks completely different, but its code is consistent with something normal.”

Hamlen said Frankenstein could be used to aid government counter terrorism efforts by providing cover for infiltration of terrorist computer networks. Hamlen is part of the Cyber Security Research and Education Center in the Erik Jonsson School of Engineering and Computer Science.

The UT Dallas research is the first published example describing this type of stealth technology, Hamlen said.

“As a proof-of-concept, we tested Frankenstein on some simple algorithms that are completely benign,” Hamlen said. “We did not create damage to anyone’s systems.”

The next step, Hamlen said, is to create more complex versions of the software.

Frankenstein was described in a paper published online in conjunction with a presentation at a recent USENIX Workshop on Offensive Technologies.

The research was supported by the National Science Foundation and Air Force Office of Scientific Research.

Featured

  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3