Pith. sign in

REVIEW 2 minor 25 references

Evading and crashing anti-malware solutions via data collection overloading during analysis serialization

T0 review · 0 major / 2 minor · reviewed 2026-05-21 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Malware can evade analysis or crash sandboxes by overloading telemetry collection with deeply nested data structures.

desk verdict Recursive child process spawning can overload telemetry pipelines and cause denial-of-analysis in multiple real sandbox and EDR products. read the letter →

arxiv 2511.04472 v3 pith:4Z3FUWDS submitted 2025-11-06 cs.CR

Evgenios Gkritsis , Constantinos Patsakis , George Stergiopoulos This is my paper · ORCID
classification cs.CR
keywords malwareanalysistelemetrycomplexityattacksdenialofserializationvulnerabilitiessandboxevasionEDRsecuritydatacollectionoverload
checked against Foundation.AbsoluteFloorClosureFoundation.ArithmeticFromLogic
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper demonstrates that malware analysis systems depend on telemetry pipelines for collecting, serializing, and storing program behavior, creating an exploitable weakness. Attackers generate deeply nested and oversized objects through recursive child processes to exceed limits in JSON serializers, databases, and visualization layers. This produces denial-of-analysis states where reports are truncated, inserts are rejected, or dashboards become unresponsive, all without elevated privileges or sensor disabling. Evaluation on 18 commercial and open-source platforms shows seven failures at various pipeline stages, with assigned CVEs and subsequent patches for some products. The work identifies root causes in unbounded collection mechanisms and suggests mitigations like adding depth and size bounds.

What carries the argument

Telemetry Complexity Attacks, which use recursive child process spawning to generate deeply nested and oversized objects that exceed serialization, storage, and visualization limits in telemetry pipelines.

What would settle it

A sandbox that enforces strict depth limits on nested objects or terminates recursive process creation before data overload occurs, resulting in complete behavioral reports for all tested cases.

Watch

Extended reading notes

Core claim

Telemetry Complexity Attacks (TCAs) exploit mismatches between unbounded collection mechanisms and bounded processing capabilities in analysis environments. The method recursively spawns child processes to create deeply nested and oversized objects that stress serialization boundaries such as JSON/BSON depth and size limits, as well as storage and visualization components. Depending on the product, this results in truncated or missing behavioral reports, rejected database inserts, serializer errors, or unresponsive interfaces, with some cases showing normal malicious execution that goes unrecorded.

Load-bearing premise

The attack assumes analysis environments permit recursive child process creation and unbounded collection of nested objects without early termination or built-in detection.

Editorial extensions

If this is right

  • Seven of the 18 evaluated platforms fail at different stages of the telemetry pipeline, including serialization errors and missing reports.
  • Malicious execution can complete without being recorded or presented to analysts in affected products.
  • Specific vulnerabilities have received CVE assignments, with patches or configuration changes issued by some vendors.
  • Root causes trace to absence of bounds on collection depth, size, and recursion in data-handling components.
  • Mitigation strategies include implementing limits and validation checks in serializers and storage backends.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Similar overload risks may affect other security monitoring tools that ingest unbounded data from untrusted processes.
  • Adding explicit recursion and size limits to collection agents would reduce exposure across analysis platforms.
  • The approach could serve as a test case for evaluating robustness in log aggregation or incident response systems.
  • Automated monitoring for excessive nesting patterns might help detect such attacks in real time.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

0 major / 2 minor

Summary. The paper introduces Telemetry Complexity Attacks (TCAs) as a new vulnerability class targeting the telemetry pipelines (collection, serialization, storage, and visualization) of malware analysis sandboxes and DFIR platforms. It demonstrates that recursive child-process spawning can generate deeply nested and oversized objects that trigger denial-of-analysis (DoA) states—such as truncated reports, serializer errors, rejected inserts, and unresponsive dashboards—without elevated privileges or sensor disabling. Evaluation against 18 commercial and open-source products shows failures in seven cases, with two CVEs assigned (CVE-61301, CVE-61303) and others patched.

Significance. If the empirical results hold, the work identifies a practical attack surface in widely deployed security tools that has received little prior attention. Direct testing on real products, observation of concrete failure modes, and assignment of CVEs provide strong evidence of impact. The paper also names the attack class, discusses root causes, and offers mitigation strategies, which could inform both vendors and defenders.

minor comments (2)
  1. The abstract and §1 could more explicitly state the exact depth and size thresholds at which each of the seven failing products crashed or truncated, to allow easier reproduction and comparison with future work.
  2. Figure 3 (or equivalent) showing the nested object structure would benefit from an accompanying textual description of the recursion depth used in the experiments.

Simulated Author's Rebuttal

0 responses · 0 unresolved

We thank the referee for their positive assessment of our work on Telemetry Complexity Attacks and for recommending acceptance. We appreciate the recognition of the practical impact demonstrated through evaluation on 18 products, the assignment of CVEs, and the discussion of root causes and mitigations.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity

full rationale

The paper presents an empirical security evaluation of telemetry pipelines in malware analysis and EDR products. Its central claim—that recursive child-process spawning can induce denial-of-analysis states—is substantiated by direct testing against 18 external commercial and open-source systems, with concrete failure modes, assigned CVEs, and reported patches. No equations, fitted parameters, or first-principles derivations appear; the work contains no self-citation chains that bear the load of the result, no uniqueness theorems imported from prior author work, and no renaming of known patterns as novel unification. The demonstration is externally falsifiable through reproduction on the named products and therefore self-contained against external benchmarks.

Assumptions & free parameters 0 free parameters · 1 assumptions · 1 invented entities

The central claim rests on the existence of telemetry pipelines with unbounded collection in analysis systems and the ability to spawn child processes without sandbox interference; no free parameters are fitted and no new physical entities are postulated.

assumptions (1)
  • domain assumption Analysis systems use collection agents, serializers, and database backends that can receive unbounded nested data structures.
    Invoked in the description of the telemetry pipeline and the attack surface.
invented entities (1)
  • Telemetry Complexity Attacks (TCAs)
    purpose: New class of vulnerabilities exploiting data handling mismatches
    Introduced to categorize the recursive nesting technique and its effects on serialization limits.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Evading and crashing anti-malware solutions via data collection overloading during analysis serialization." pith.science (2026). https://pith.science/paper/4Z3FUWDS

@misc{pith2026251104472,
  author       = {Pith},
  title        = {Pith review of: Evading and crashing anti-malware solutions via data collection overloading during analysis serialization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4Z3FUWDS}},
  note         = {Machine review of arXiv:2511.04472}
}
read the original abstract

Malware analysis systems, including dynamic-analysis sandboxes and digital forensics and incident response (DFIR) platforms, rely on telemetry pipelines comprising collection agents, serializers, and database backends to capture and present program behavior to analysts. We show that these data-handling components constitute an exploitable attack surface that can lead to denial-of-analysis (DoA) states without disabling sensors or requiring elevated privileges. We present Telemetry Complexity Attacks (TCAs), a new class of vulnerabilities that exploit mismatches between unbounded collection mechanisms and bounded processing capabilities. Our method recursively spawns child processes to generate deeply nested and oversized objects that stress serialization and storage boundaries, as well as visualization layers, e.g., JSON/BSON depth and size limits. Depending on the product, this leads to truncated or missing behavioral reports, rejected database inserts, serializer recursion and size errors, and unresponsive dashboards, with some cases also exhibiting normal malicious execution that was not recorded or presented to analysts. We evaluate our technique against 18 commercial and open-source malware analysis platforms and endpoint detection and response (EDR) solutions. Seven products fail at different stages of the telemetry pipeline; two CVE identifiers have been assigned (CVE-61301 and CVE-61303); one more is pending; one has been assigned to an underlying library, and others have issued patches or configuration changes. We discuss root causes and propose mitigation strategies to prevent DoA attacks triggered by adversarial telemetry.

Figures

Figures reproduced from arXiv: 2511.04472 by the authors.

Figure 1
Figure 1. Overview of our methodology Let us consider a trivial example of a malware that is executed in a malware sandbox. Its execution triggers some processes for which the malware sandbox would timestamp, keep track of the parent and children processes, or even store their memory dumps. The natural way to represent this information is through a tree; however, if you need to share this information with others or store it i… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

25 extracted references · 25 canonical work pages

  1. [1]

    EvilEDR: Repurposing EDR as an offensive tool

    Kotaiba Alachkar, Dirk Gaastra, Eduardo Barbaro, Michel van Eeten, and Yury Zhauniarovich. EvilEDR: Repurposing EDR as an offensive tool. In34th USENIX Security Symposium (USENIX Security 25), pages 587–605, 2025

    work page 2025

  2. [2]

    Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks.Future Generation Computer Systems, 116:393–405, 2021

    Theodoros Apostolopoulos, Vasilios Katos, Kim-Kwang Raymond Choo, and Constantinos Patsakis. Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks.Future Generation Computer Systems, 116:393–405, 2021

    work page 2021

  3. [3]

    Dealing with process overload attacks in unix.Information Security Journal: A Global Perspective, 17(1):33–44, 2008

    Michele Berlot and Janche Sang. Dealing with process overload attacks in unix.Information Security Journal: A Global Perspective, 17(1):33–44, 2008

    work page 2008

  4. [4]

    A survey on automated dynamic malware analysis evasion and counter-evasion: Pc, mobile, and web

    Alexei Bulazel and B¨ ulent Yener. A survey on automated dynamic malware analysis evasion and counter-evasion: Pc, mobile, and web. InProceedings of the 1st Reversing and Offensive- oriented Trends Symposium, pages 1–21, 2017

    work page 2017

  5. [5]

    A survey on automated dynamic malware analysis evasion and counter-evasion: Pc, mobile, and web

    Alexei Bulazel and B¨ ulent Yener. A survey on automated dynamic malware analysis evasion and counter-evasion: Pc, mobile, and web. InProceedings of the 1st Reversing and Offensive- Oriented Trends Symposium, ROOTS, New York, NY, USA, 2017. Association for Computing Machinery

    work page 2017

  6. [6]

    The dark side of EDR: Repurpose EDR as an offensive tool

    Shmuel Cohen. The dark side of EDR: Repurpose EDR as an offensive tool. https://www.safebreach.com/blog/dark-side-of-edr-offensive-tool/, 2024. 14

    work page 2024

  7. [7]

    Markelon, Kenneth G

    Mia Filic, Jonas Hofmann, Sam A. Markelon, Kenneth G. Paterson, and Anupama Unnikrish- nan. Probabilistic data structures in the wild: A security analysis of redis. In James Joshi, Jaideep Vaidya, and Haya Schulmann, editors,Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, CODASPY 2025, Pittsburgh, PA, USA, June 4-...

    work page 2025

  8. [8]

    A systematical and longitudinal study of evasive behaviors in windows malware.Comput

    Nicola Galloro, Mario Polino, Michele Carminati, Andrea Continella, and Stefano Zanero. A systematical and longitudinal study of evasive behaviors in windows malware.Comput. Secur., 113:102550, 2022

    work page 2022

Show all 25 references
  1. [9]

    Hookchain: A new perspective for bypassing edr solutions.arXiv preprint arXiv:2404.16856, 2024

    Helvio Carvalho Junior. Hookchain: A new perspective for bypassing edr solutions.arXiv preprint arXiv:2404.16856, 2024

    2024

  2. [10]

    An empirical assessment of endpoint detec- tion and response systems against advanced persistent threats attack vectors.Journal of Cybersecurity and Privacy, 1(3):387–421, 2021

    George Karantzas and Constantinos Patsakis. An empirical assessment of endpoint detec- tion and response systems against advanced persistent threats attack vectors.Journal of Cybersecurity and Privacy, 1(3):387–421, 2021

    2021

  3. [11]

    The power of procrastination: detection and mitigation of execution-stalling malicious code

    Clemens Kolbitsch, Engin Kirda, and Christopher Kruegel. The power of procrastination: detection and mitigation of execution-stalling malicious code. InProceedings of the 18th ACM Conference on Computer and Communications Security, CCS ’11, page 285–296, New York, NY, USA, 201...

    2011

  4. [12]

    Python and malware: Developing stealth and evasive malware without obfuscation.arXiv preprint arXiv:2105.00565, 2021

    Vasilios Koutsokostas and Constantinos Patsakis. Python and malware: Developing stealth and evasive malware without obfuscation.arXiv preprint arXiv:2105.00565, 2021

    2021

  5. [13]

    Does every second count? time-based evolution of malware behavior in sandboxes

    Alexander K¨ uchler, Alessandro Mantovani, Yufei Han, Leyla Bilge, and Davide Balzarotti. Does every second count? time-based evolution of malware behavior in sandboxes. In28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021...

    2021

  6. [14]

    Lewis and Bhaskar P

    Trevor M. Lewis and Bhaskar P. Rimal. Effects of removing user-land hooks in endpoint protection during attack experiments.IEEE Access, 12:15820–15844, 2024

    2024

  7. [15]

    ReDoSHunter: A combined static and dynamic approach for eliminating regular expression DoS vulnerabilities

    Yeting Li, Qirun Chen, Yichen Wang, and Shuo Chen. ReDoSHunter: A combined static and dynamic approach for eliminating regular expression DoS vulnerabilities. InUSENIX Security Symposium, 2021

    2021

  8. [16]

    RegexScalpel: Regular expression denial of service vulnerability repair

    Yeting Li, Jingxuan Zhou, Yichen Wang, Wei Xu, and Shuo Chen. RegexScalpel: Regular expression denial of service vulnerability repair. InUSENIX Security Symposium, 2022

    2022

  9. [17]

    Gomez, Juan Tapiador, and Andrea Lanzi

    Antonio Nappa, Panagiotis Papadopoulos, Matteo Varvello, Diego A. Gomez, Juan Tapiador, and Andrea Lanzi. Pow-How: An enduring timing side-channel to evade online malware sandboxes. InEuropean Symposium on Research in Computer Security (ESORICS), 2021

    2021

  10. [18]

    Keromytis, and Suman Jana

    Theofilos Petsios, Iasonas Polakis, Angelos D. Keromytis, and Suman Jana. Slowfuzz: Au- tomated domain-independent detection of algorithmic complexity vulnerabilities. InACM Conference on Computer and Communications Security (CCS), 2017

    2017

  11. [19]

    Microsoft defender will be defended: Memoryranger prevents blinding windows av.arXiv preprint arXiv:2210.02821, 2022

    Denis Pogonin and Igor Korkin. Microsoft defender will be defended: Memoryranger prevents blinding windows av.arXiv preprint arXiv:2210.02821, 2022

    2022

  12. [20]

    Laughter in the wild: A study into dos vulnerabilitiesinyamllibraries

    Shawn Rasheed, Jens Dietrich, and Amjed Tahir. Laughter in the wild: A study into dos vulnerabilitiesinyamllibraries. In2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science...

    2019

  13. [21]

    Cardinal pill testing of system virtual machines

    Hao Shi, Abdulla Alwabel, and Jelena Mirkovic. Cardinal pill testing of system virtual machines. In23rd USENIX Security Symposium (USENIX Security 14), pages 271–285, San Diego, CA, August 2014. USENIX Association. 15

    2014

  14. [22]

    On breaking SAML: Be whoever you want to be

    Juraj Somorovsky, Andreas Mayer, J¨ org Schwenk, Marco Kampmann, and Meiko Jensen. On breaking SAML: Be whoever you want to be. In21st USENIX Security Symposium (USENIX Security 12), pages 397–412, Bellevue, WA, August 2012. USENIX Association

    2012

  15. [23]

    SoK: XML parser vulnerabilities

    Christopher Sp¨ ath, Christian Mainka, Vladislav Mladenov, and J¨ org Schwenk. SoK: XML parser vulnerabilities. In10th USENIX Workshop on Offensive Technologies (WOOT 16), Austin, TX, August 2016. USENIX Association

    2016

  16. [24]

    Exposing ReDoS vulnerability of non-backtracking matchers

    Lenka Turonov’a, Johan Jeuring, and Arie Middelkoop. Exposing ReDoS vulnerability of non-backtracking matchers. InUSENIX Security Symposium, 2022

    2022

  17. [25]

    Sandprint: Fingerprinting malware sandboxes to provide intelligence for sandbox evasion

    Akira Yokoyama, Kazuya Ishii, Ryota Tanabe, Yuto Papa, Katsunari Yoshioka, Takashi Matsumoto, Tatsuya Kasama, Daisuke Inoue, Michael Brengel, Michael Backes, and Christian Rossow. Sandprint: Fingerprinting malware sandboxes to provide intelligence for sandbox evasion. InResear...

    2016

Pith tools

Reviewed May 21, 2026 · model on record in the stance chip above.