Concordia: a Google for malware

  • Authors:
  • Timothy Daly;Luanne Burns

  • Affiliations:
  • Software Engineering Institute, Pittsburgh, PA;Software Engineering Institute, Pittsburgh, PA

  • Venue:
  • Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

This paper introduces a new architecture for automating the generalization of program structure and the recognition of common patterns. By using massively parallel processing on large program sets we can recognize common code sequences such as loop constructs, if-then-else structures, and subroutine calls. We can also recognize common library sequences. The Concordia architecture generalizes the recognized elements so they can be collected into invariant forms. The invariant forms can be used by the analyst to understand the program being analyzed. The invariant forms can also be used to classify large numbers of programs automatically.