Malware Phylogeny Generation using Permutations of Code

DMCA

Malware Phylogeny Generation using Permutations of Code (2005)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Md Enamul Karim , Andrew Walenstein , Arun Lakhotia , Laxmi Parida

Venue:	JOURNAL IN COMPUTER VIROLOGY
Citations:	43 - 6 self

BibTeX

@ARTICLE{Karim05malwarephylogeny,
    author = {Md Enamul Karim and Andrew Walenstein and Arun Lakhotia and Laxmi Parida},
    title = { Malware Phylogeny Generation using Permutations of Code},
    journal = {JOURNAL IN COMPUTER VIROLOGY },
    year = {2005},
    volume = {1},
    pages = {13--23}
}

OpenURL

Abstract

Malicious programs, such as viruses and worms, are frequently related to previous programs through evolutionary relationships. Discovering those relationships and constructing a phylogeny model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. Matching permutations of code may help build better models in cases where malware evolution does not keep things in the same order. We describe method for constructing phylogeny models that uses features called n-perms to match possibly permuted code. An experiment was performed to compare the relative effectiveness of vector similarity measures using n-perms and n-grams when comparing permuted variants of programs. The similarity measures using n-perms maintained a greater separation between the similarity scores of permuted families of specimens versus unrelated specimens. A subsequent study using a tree generated through suggests that phylogeny models based on may help forensic analysts investigate new specimens, and assist in reconciling malware naming inconsistencies.

Keyphrases

malware phylogeny generation phylogeny model new specimen principled naming scheme malware evolution new malware permuted family evolutionary relationship similarity score previous program subsequent study malicious program relative effectiveness vector similarity measure unrelated specimen

DMCA