DMCA
S.: Static analyzer of vicious executables (save
| Venue: | In: Proceedings of the 20th Annual Computer Security Applications Conference (2004 |
| Citations: | 24 - 2 self |
BibTeX
@INPROCEEDINGS{Sung_s.:static,
author = {A. H. Sung and J. Xu and P. Chavez and S. Mukkamala},
title = {S.: Static analyzer of vicious executables (save},
booktitle = {In: Proceedings of the 20th Annual Computer Security Applications Conference (2004},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Software security assurance and malware (trojans, worms, and viruses, etc.) detection are important topics of information security. Software obfuscation, a general technique that is useful for protecting software from reverse engineering, can also be used by hackers to circumvent the malware detection tools. Current static malware detection techniques have serious limitations, and sandbox testing also fails to provide a complete solution due to time constraints. In this paper, we present a robust signature-based malware detection technique, with emphasis on detecting obfuscated (or polymorphic) malware and mutated (or metamorphic) malware. The hypothesis is that all versions of the same malware share a common core signature that is a combination of several features of the code. After a particular malware has been first identified, it can be analyzed to extract the signature, which provides a basis for detecting variants and mutants of the same malware in the future. Encouraging experimental results on a large set of recent malware are presented.
Keyphrases
vicious executables static analyzer recent malware robust signature-based malware detection technique serious limitation software security assurance reverse engineering common core signature malware share sandbox testing information security complete solution particular malware current static malware detection technique large set several feature malware detection tool important topic time constraint general technique software obfuscation encouraging experimental result
