Computing the behavior of malware

Authors:
Rick Linger;Mark Pleszkoch;Kirk Sayre;Tim Daly
Affiliations:
CERT/Software Engineering Institute, Pittsburgh, PA;CERT/Software Engineering Institute, Pittsburgh, PA;CERT/Software Engineering Institute, Pittsburgh, PA;CERT/Software Engineering Institute, Pittsburgh, PA
Venue:
Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research
Year:
2010

Citing 5
Cited 0

A practical introduction to denotational semantics

A practical introduction to denotational semantics
Cleanroom software engineering: technology and process

Cleanroom software engineering: technology and process
Improving Network System Security with Function Extraction Technology for Automated Calculation of Program Behavior

HICSS '04 Proceedings of the Proceedings of the 37th Annual Hawaii International Conference on System Sciences (HICSS'04) - Track 9 - Volume 9
Next-Generation Software Engineering: Function Extraction for Computation of Software Behavior

HICSS '07 Proceedings of the 40th Annual Hawaii International Conference on System Sciences
Introducing function extraction into software testing

ACM SIGMIS Database

Quantified Score

Hi-index	0.00

Visualization

Abstract

As the quantity and sophistication of malicious code continues to grow, automation support for analysis becomes more important to keep pace with the scope and scale of the problem. To help address this need, CERT has been conducting research and development on Function Extraction (FX) technology for automated computation of software behavior, including malware behavior. Intruders often obfuscate malware packages to make analysis more difficult by inserting massive amounts of arbitrary jumps in code that thwart control flow tracing, and by adding blocks of no-op code that have no functional effect but must nevertheless be analyzed. A specialization of FX technology in the Function Extraction for Malicious Code (FX/MC) system is designed to address these obfuscation problems.