DMCA
Exploring multiple execution paths for malware analysis (2007)
Cached
Download Links
| Venue: | In Security and Privacy, 2007. SP ’07. IEEE Symposium on |
| Citations: | 151 - 13 self |
BibTeX
@INPROCEEDINGS{Moser07exploringmultiple,
author = {Andreas Moser and Christopher Kruegel and Engin Kirda},
title = {Exploring multiple execution paths for malware analysis},
booktitle = {In Security and Privacy, 2007. SP ’07. IEEE Symposium on},
year = {2007},
pages = {231--245}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Malicious code (or malware) is defined as software that fulfills the deliberately harmful intent of an attacker. Malware analysis is the process of determining the behavior and purpose of a given malware sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques and removal tools. Currently, malware analysis is mostly a manual process that is tedious and time-intensive. To mitigate this problem, a number of analysis tools have been proposed that automatically extract the behavior of an unknown program by executing it in a restricted environment and recording the operating system calls that are invoked. The problem of dynamic analysis tools is that only a single program execution is observed. Unfortunately, however, it is possible that certain malicious actions are only triggered under specific circumstances (e.g., on a particular day, when a certain file is present, or when a certain command is received). In this paper, we propose a system that allows us to explore multiple execution paths and identify malicious actions that are executed only when certain conditions are met. This enables us to automatically extract a more complete view of the program under analysis and identify under which circumstances suspicious actions are carried out. Our experimental results demonstrate that many malware samples show different behavior depending on input read from the environment. Thus, by exploring multiple execution paths, we can obtain a more complete picture of their actions. 1
Keyphrases
malware analysis multiple execution path many malware sample restricted environment certain condition removal tool malicious code analysis tool certain file unknown program certain malicious action malicious action harmful intent dynamic analysis tool single program execution circumstance suspicious action particular day complete view specific circumstance certain command complete picture operating system effective detection technique malware sample manual process trojan horse experimental result necessary step different behavior
