Using Engine Signature to Detect Metamorphic Malware

DMCA

Using Engine Signature to Detect Metamorphic Malware

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Mohamed R. Chouchane

Citations:

9 - 2 self

BibTeX

@MISC{Chouchane_usingengine,
    author = {Mohamed R. Chouchane},
    title = {Using Engine Signature to Detect Metamorphic Malware},
    year = {}
}

OpenURL

Abstract

This paper introduces the “engine signature ” approach to assist in detecting metamorphic malware by tracking it to its engine. More specifically, it presents and evaluates a code scoring technique for collecting forensic evidence from x86 code segments in order to get some measure of how likely they are to have been generated by some known instruction-substituting metamorphic engine. A prototype simulator that mimics real instruction-substituting metamorphic engines was implemented and used to conduct several experiments that evaluate the goodness of the scoring technique for given engine parameters. The technique was also used to successfully help track variants of W32.Evol to their engine.

Keyphrases

detect metamorphic malware engine signature metamorphic malware forensic evidence engine signature approach prototype simulator several experiment mimic real instruction-substituting metamorphic engine x86 code segment code scoring technique instruction-substituting metamorphic engine engine parameter scoring technique track variant

DMCA