A New Approach to Malware Detection

Authors:
Hongying Tang;Bo Zhu;Kui Ren
Affiliations:
Concordia Institute for Information Systems Engineering, Concordia University,;Concordia Institute for Information Systems Engineering, Concordia University,;Department of Electrical and Computer Engineering, Illinois Institute of Technology,
Venue:
ISA '09 Proceedings of the 3rd International Conference and Workshops on Advances in Information Security and Assurance
Year:
2009

Citing 8
Cited 0

Specifying the Semantics of Machine Instructions

IWPC '98 Proceedings of the 6th International Workshop on Program Comprehension
Testing malware detectors

ISSTA '04 Proceedings of the 2004 ACM SIGSOFT international symposium on Software testing and analysis
Semantics-Aware Malware Detection

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Static analysis of executables to detect malicious patterns

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Normalization towards Instruction Substitution Metamorphism Based on Standard Instruction Set

CISW '07 Proceedings of the 2007 International Conference on Computational Intelligence and Security Workshops
Dynamic spyware analysis

ATC'07 2007 USENIX Annual Technical Conference on Proceedings of the USENIX Annual Technical Conference
Detecting self-mutating malware using control-flow graph matching

DIMVA'06 Proceedings of the Third international conference on Detection of Intrusions and Malware & Vulnerability Assessment
Polymorphic worm detection using structural information of executables

RAID'05 Proceedings of the 8th international conference on Recent Advances in Intrusion Detection

Quantified Score

Hi-index	0.00

Visualization

Abstract

Malware has become one of the most serious threats to computer users. Early techniques based on syntactic signatures can be easily bypassed using program obfuscation. A promising direction is to combine Control Flow Graph (CFG) with instruction-level information. However, since previous work includes only coarse information, i.e., the classes of instructions of basic blocks, it results in false positives during the detection. To address this issue, we propose a new approach that generates formalized expressions upon assignment statements within basic blocks. Through combining CFG with the functionalities of basic blocks, which are represented in terms of upper variables with their corresponding formalized expressions and system calls (if any), our approach can achieve more accurate malware detection compared to previous CFG-based solutions.