Graduate School and Research Center in Digital Sciences

Backdoors: Definition, deniability and detection

Thomas, Sam L; Francillon, Aurélien

RAID 2018, 21st International Symposium on Research in Attacks, Intrusions and Defenses, 10-12 September 2018, Heraklion, Crete, Greece

Detecting backdoors is a difficult task; automating that detection process is equally challenging. Evidence for these claims lie in both the lack of automated tooling, and the fact that the vast majority of real-world backdoors are still detected by labourious manual analysis. The term backdoor, casually used in both the literature and the media, does not have a concrete or rigorous definition. In this work we provide such a definition. Further, we present a framework for reasoning about backdoors through four key components, which allows them to be modelled succinctly and provides a means of rigorously defining the process of their detection. Moreover, we introduce the notion of deniability in regard to backdoor implementations which permits reasoning about the attribution and accountability of backdoor implementers. We show our framework is able to model eleven, diverse, real-world backdoors, and one, more complex backdoor from the literature, and, in doing so, provides a means to reason about how they can be detected and their deniability. Further, we demonstrate how our framework can be used to decompose backdoor detection methodologies, which serves as a basis for developing future backdoor detection tools, and shows how current state-of-the-art approaches consider neither a sound nor complete model.

Document Doi Hal Bibtex

Title:Backdoors: Definition, deniability and detection
Keywords:Backdoors, Formalisation of definitions, Program analysis
Type:Conference
Language:English
City:Heraklion
Country:GREECE
Date:
Department:Digital Security
Eurecom ref:5602
Copyright: © Springer. Personal use of this material is permitted. The definitive version of this paper was published in RAID 2018, 21st International Symposium on Research in Attacks, Intrusions and Defenses, 10-12 September 2018, Heraklion, Crete, Greece and is available at : http://doi.org/10.1007/978-3-030-00470-5_5
Bibtex: @inproceedings{EURECOM+5602, doi = {http://doi.org/10.1007/978-3-030-00470-5_5}, year = {2018}, title = {{B}ackdoors: {D}efinition, deniability and detection}, author = {{T}homas, {S}am {L} and {F}rancillon, {A}ur{\'e}lien}, booktitle = {{RAID} 2018, 21st {I}nternational {S}ymposium on {R}esearch in {A}ttacks, {I}ntrusions and {D}efenses, 10-12 {S}eptember 2018, {H}eraklion, {C}rete, {G}reece}, address = {{H}eraklion, {GREECE}}, month = {09}, url = {http://www.eurecom.fr/publication/5602} }
See also: