Daria Pietraszko, a graduate of the Faculty of Information and Communication Technology, has become the laureate of the NASK Award for the Best Cybersecurity Thesis. She received the distinction during the 31st ICT Forum organised at the Ministry of Digital Affairs. Congratulations!

The Forum is one of the largest and most prestigious events of this type in Poland. It is devoted to addressing key issues related to the practical applications of information technology in the public administration and economy of Poland.

The event is held under the honorary patronage of the Ministry of Digital Affairs, the National Bank of Poland, the Government Security Centre, the Rector of the University of Warsaw, and the President of the Polish Information Technology Society.

During the Forum, awards are traditionally presented to the winners of the nationwide Young Masters Competition. This year, NASK experts recognised the master’s thesis entitled “Development of a solution based on virtual machine introspection to detect rootkit-type malware,” written by Daria Pietraszko from our Faculty under the supervision of Dr. Wojciech Wodo from the Department of Telecommunications and Teleinformatics.

In the justification, the jury emphasised that the awarded thesis stood out not only for its high substantive quality, but also for its strong practical implementation potential.

– Supporting young Polish talents is one of the key investments in the future of our country. Every project that emerges at universities today can become the foundation of systems protecting public administration, business, or citizens from advanced attacks tomorrow. That is why it is so important to support courage, creativity, and responsibility among young specialists already at the stage of their studies and early scientific research – emphasised Radosław Nielek, Director of NASK, during the ceremony.

It is worth noting that the thesis also won second place in the Nationwide Competition of the Polish Information Technology Society for the Best Master’s Theses in Computer Science and first place in the Polish Association of Electrical Engineers Competition for the Best Diploma Thesis in the 2024/2025 academic year.

How to track down invisible digital parasites?

In her thesis, our graduate developed a rootkit malware detection system using virtual machine introspection techniques.

– I developed an original system that detects rootkits – a type of malicious software capable of hiding from standard security mechanisms. The solution operates at the virtualisation level (the hypervisor), i.e. a layer that is generally inaccessible and beyond the reach of a typical rootkit. It is a bit like observing a thief from the perspective of a camera they cannot hide from – explains Daria Pietraszko.

A photo of four people standing next to each other, with a woman holding a diploma and an award.

Our laureate has been interested in malware-related topics for quite some time. Several years ago, together with colleagues from the White Hats Student Research Club, she developed a malware analysis environment as part of the Malwarelab project, based on the Drakvuf Sandbox developed by CERT Polska.

– The Drakvuf Sandbox itself is based on the Drakvuf project by Tamas K. Lengyel, which in turn uses the LibVMI library by the same author, designed for virtual machine introspection. It was precisely this library, together with the concept of introspection itself, that particularly caught my interest – explains our graduate.

– I also based my engineering thesis on the Drakvuf Sandbox, but at some point I wanted to go further and create something of my own, still related to the topic but reaching deeper. I therefore decided to look two components lower than before. As for rootkits themselves, my attention was drawn to them by materials related to Drakvuf. I often encountered information suggesting that this solution is difficult to detect even by the most advanced malware, which intrigued me enough to investigate what these sophisticated threats actually are – she adds.

The award winner admits that the greatest challenge in preparing the thesis was definitely the technical aspect, while the idea itself and the theoretical assumptions of detection were relatively straightforward.

– The difficulties began during the implementation phase. First, I had to thoroughly learn the selected hypervisor – the configuration file syntax, available networking options, and other technical aspects. I also needed appropriate hardware, because installing Xen on my standard computer could have ended badly, and a virtual machine was not an option either, as nested virtualisation does not work very well in this case – explains Daria Pietraszko.

Next came the compilation and configuration of virtual machine introspection tools, and above all learning how to use the LibVMI library in one’s own code. The laureate points out that the documentation is quite decent, but she still had to browse the repository source code to reach some undocumented functionalities.

– At some point, I also realised that working with raw memory in this case was more difficult than I had expected. For example, I had to parse the internal structures of the Windows system using my own solutions. This required a very detailed understanding of these structures and searching through blogs and unofficial documentation, because some of them were either not officially documented or differed depending on the Windows version – notes the WIT graduate.

A considerable amount of time was also spent selecting appropriate malware samples and debugging the code.

– The research results were a very positive surprise for me. I did not expect such high detection effectiveness or such a low level of false positives. I was also surprised by several aspects related to the internal structures of the Windows system – admits Daria Pietraszko, who plans to continue her research at Wrocław University of Science and Technology as part of her doctoral studies.