Omniunpack: Fast, generic, and safe unpacking of malware

DMCA

Omniunpack: Fast, generic, and safe unpacking of malware (2007)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Lorenzo Martignoni , Mihai Christodorescu , Somesh Jha

Venue:	In Proceedings of the Annual Computer Security Applications Conference (ACSAC
Citations:	57 - 0 self

BibTeX

@INPROCEEDINGS{Martignoni07omniunpack:fast,,
    author = {Lorenzo Martignoni and Mihai Christodorescu and Somesh Jha},
    title = {Omniunpack: Fast, generic, and safe unpacking of malware},
    booktitle = {In Proceedings of the Annual Computer Security Applications Conference (ACSAC},
    year = {2007}
}

OpenURL

Abstract

Malicious software (or malware) has become a growing threat as malware writers have learned that signaturebased detectors can be easily evaded by “packing ” the malicious payload in layers of compression or encryption. State-of-the-art malware detectors have adopted both static and dynamic techinques to recover the payload of packed malware, but unfortunately such techniques are highly ineffective. In this paper we propose a new technique, called OmniUnpack, to monitor the execution of a program in real-time and to detect when the program has removed the various layers of packing. OmniUnpack aids malware detection by directly providing to the detector the unpacked malicious payload. Experimental results demonstrate the effectiveness of our approach. OmniUnpack is able to deal with both known and unknown packing algorithms and introduces a low overhead (at most 11 % for packed benign programs). 1.

Keyphrases

safe unpacking new technique various layer malicious software unpacked malicious payload packed malware dynamic techinques benign program low overhead malicious payload malware writer unknown packing algorithm experimental result omniunpack aid malware detection signaturebased detector state-of-the-art malware detector

DMCA