A similarity metric method of obfuscated malware using function-call graph

  • Authors:

  • Ming Xu;Lingfei Wu;Shuhui Qi;Jian Xu;Haiping Zhang;Yizhi Ren;Ning Zheng

  • Affiliations:

  • College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China;College of Computer, Hangzhou Dianzi University, Hangzhou, China

  • Venue:
  • Journal in Computer Virology
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

Code obfuscating technique plays a significant role to produce new obfuscated malicious programs, generally called malware variants, from previously encountered malwares. However, the traditional signature-based malware detecting method is hard to recognize the up-to-the-minute obfuscated malwares. This paper proposes a method to identify the malware variants based on the function-call graph. Firstly, the function-call graphs were created from the disassembled codes of program; then the caller---callee relationships of functions and the operational code (opcode) information about functions, combining the graph coloring techniques were used to measure the similarity metric between two function-call graphs; at last, the similarity metric was utilized to identify the malware variants from known malwares. The experimental results show that the proposed method is able to identify the obfuscated malicious softwares effectively.