Analyzing program dependencies for malware detection

  • Authors:

  • Mila Dalla Preda;Isabella Mastroeni;Roberto Giacobazzi

  • Affiliations:

  • Dipartimento di Informatica - University of Verona, Italy;Dipartimento di Informatica - University of Verona, Italy;Dipartimento di Informatica - University of Verona, Italy

  • Venue:
  • Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop 2014
  • Year:
  • 2014

Quantified Score

Hi-index 0.00

Visualization

Abstract

Metamorphic malware continuously modify their code, while preserving their functionality, in order to foil misuse detection. The key for defeating metamorphism relies in a semantic characterization of the embedding of the malware into the target program. Indeed, a behavioral model of program infection that does not relay on syntactic program features should be able to defeat metamorphism. Moreover, a general model of infection should be able to express dependences and interactions between the malicious code and the target program. ANI is a general theory for the analysis of dependences of data in a program. We propose an high order theory for ANI, later called HOANI, that allows to study program dependencies. Our idea is then to formalize and study the malware detection problem in terms of HOANI.