Signature Generation and Detection of Malware Families

  • Authors:

  • V. Sai Sathyanarayan;Pankaj Kohli;Bezawada Bruhadeshwar

  • Affiliations:

  • Centre for Security, Theory and Algorithmic Research (C-STAR), International Institute of Information Technology, Hyderabad, India 500032;Centre for Security, Theory and Algorithmic Research (C-STAR), International Institute of Information Technology, Hyderabad, India 500032;Centre for Security, Theory and Algorithmic Research (C-STAR), International Institute of Information Technology, Hyderabad, India 500032

  • Venue:
  • ACISP '08 Proceedings of the 13th Australasian conference on Information Security and Privacy
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Malware detection and prevention is critical for the protection of computing systems across the Internet. The problem in detecting malware is that they evolveover a period of time and hence, traditional signature-based malware detectors fail to detect obfuscated and previously unseen malware executables. However, as malware evolves, some semantics of the original malware are preserved as these semantics are necessary for the effectiveness of the malware. Using this observation, we present a novel method for detection of malware using the correlation between the semantics of the malware and its API calls. We construct a base signature for an entire malware class rather than for a single specimen of malware. Such a signature is capable of detecting even unknown and advanced variants that belong to that class. We demonstrate our approach on some well known malware classes and show that any advanced variant of the malware class is detected from the base signature.