Malware obfuscation detection via maximal patterns

Authors:
Jian Li;Ming Xu;Ning Zheng;Jian Xu
Affiliations:
Institute of Computer Application Technology, Hangzhou Dianzi University, P. R. China;Institute of Computer Application Technology, Hangzhou Dianzi University, P. R. China;Institute of Computer Application Technology, Hangzhou Dianzi University, P. R. China;Institute of Computer Application Technology, Hangzhou Dianzi University, P. R. China
Venue:
IITA'09 Proceedings of the 3rd international conference on Intelligent information technology application
Year:
2009

Citing 5
Cited 1

Static Analyzer of Vicious Executables (SAVE)

ACSAC '04 Proceedings of the 20th Annual Computer Security Applications Conference
Semantics-Aware Malware Detection

SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Static analysis of executables to detect malicious patterns

SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
Ether: malware analysis via hardware virtualization extensions

Proceedings of the 15th ACM conference on Computer and communications security
Behavioral distance for intrusion detection

RAID'05 Proceedings of the 8th international conference on Recent Advances in Intrusion Detection

Disguised malware script detection system using hybrid genetic algorithm

Proceedings of the 28th Annual ACM Symposium on Applied Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Malware obfuscation is defined as a program transformation. It is always used in malware to evade detection from anti-malware software. In this paper, we propose a method to detect malware obfuscation using maximal patterns. Maximal pattern is a subsequence in malware's runtime system call sequence, which frequently appears in program execution, and can be used to describe the program specific behavior. The maximal pattern sequence is extracted from the malware's runtime system calls, and the similarity between two pattern sequences will be measured by evolutionary similarity. Based on the real-world malwares test data, the experiment results have shown that our method can efficiently detect malware obfuscation.