A generic binary analysis method for malware

  • Authors:

  • Tomonori Izumida;Kokichi Futatsugi;Akira Mori

  • Affiliations:

  • National Institute of Advanced Industrial Science and Technology, Tokyo, Japan and Japan Advanced Institute of Science and Technology, Nomi, Ishikawa, Japan;Japan Advanced Institute of Science and Technology, Nomi, Ishikawa, Japan;National Institute of Advanced Industrial Science and Technology, Tokyo, Japan

  • Venue:
  • IWSEC'10 Proceedings of the 5th international conference on Advances in information and computer security
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper, we present a novel binary analysis method for malware which combines static and dynamic techniques. In the static phase, the target address of each indirect jump is resolved using backward analysis on static single assignment form of binary code. In the dynamic phase, those target addresses that are not statically resolved are recovered by way of emulation. The method is generic in the sense that it can reveal control flows of self-extracting/obfuscated code without requiring special assumptions on executables such as compliance with standard compiler models, which is requisite for the conventional methods of static binary analysis but does not hold for many malware samples. Case studies on real-world malware examples are presented to demonstrate the effectiveness of our method.