Semantics-Aware Malware Detection

Authors:
Mihai Christodorescu;Somesh Jha;Sanjit A. Seshia;Dawn Song;Randal E. Bryant
Affiliations:
University of Wisconsin, Madison;University of Wisconsin, Madison;Carnegie Mellon University;Carnegie Mellon University;Carnegie Mellon University
Venue:
SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Year:
2005

Citing 0
Cited 114

On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits

Proceedings of the 12th ACM conference on Computer and communications security
A Method for Detecting Obfuscated Calls in Malicious Binaries

IEEE Transactions on Software Engineering
A tool for analyzing and detecting malicious mobile code

Proceedings of the 28th international conference on Software engineering
Temporal search: detecting hidden malware timebombs with virtual machines

Proceedings of the 12th international conference on Architectural support for programming languages and operating systems
Using engine signature to detect metamorphic malware

Proceedings of the 4th ACM workshop on Recurring malcode
Evading network anomaly detection systems: formal reasoning and practical techniques

Proceedings of the 13th ACM conference on Computer and communications security
A semantics-based approach to malware detection

Proceedings of the 34th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages
Analyzing network traffic to detect self-decrypting exploit code

ASIACCS '07 Proceedings of the 2nd ACM symposium on Information, computer and communications security
An architecture for generating semantics-aware signatures

SSYM'05 Proceedings of the 14th conference on USENIX Security Symposium - Volume 14
Code Normalization for Self-Mutating Malware

IEEE Security and Privacy
Mining specifications of malicious behavior

Proceedings of the the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on The foundations of software engineering
Statistical signatures for fast filtering of instruction-substituting metamorphic malware

Proceedings of the 2007 ACM workshop on Recurring malcode
Panorama: capturing system-wide information flow for malware detection and analysis

Proceedings of the 14th ACM conference on Computer and communications security
Mining specifications of malicious behavior

ISEC '08 Proceedings of the 1st India software engineering conference
Syntax vs. semantics: competing approaches to dynamic network intrusion detection

International Journal of Security and Networks
SpyProxy: execution-based detection of malicious web content

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Binary obfuscation using signals

SS'07 Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium
Dynamic spyware analysis

ATC'07 2007 USENIX Annual Technical Conference on Proceedings of the USENIX Annual Technical Conference
LISABETH: automated content-based signature generator for zero-day polymorphic worms

Proceedings of the fourth international workshop on Software engineering for secure systems
Behavioral detection of malware on mobile handsets

Proceedings of the 6th international conference on Mobile systems, applications, and services
Detecting energy-greedy anomalies and mobile malware variants

Proceedings of the 6th international conference on Mobile systems, applications, and services
Polymorphic worm detection using token-pair signatures

Proceedings of the 4th international workshop on Security, privacy and trust in pervasive and ubiquitous computing
A semantics-based approach to malware detection

ACM Transactions on Programming Languages and Systems (TOPLAS)
Ghost turns zombie: exploring the life cycle of web-based malware

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
Characterizing Bots' Remote Control Behavior

DIMVA '07 Proceedings of the 4th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Signature Generation and Detection of Malware Families

ACISP '08 Proceedings of the 13th Australasian conference on Information Security and Privacy
Dynamic Binary Instrumentation-Based Framework for Malware Defense

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Learning and Classification of Malware Behavior

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
A Layered Architecture for Detecting Malicious Behaviors

RAID '08 Proceedings of the 11th international symposium on Recent Advances in Intrusion Detection
Ether: malware analysis via hardware virtualization extensions

Proceedings of the 15th ACM conference on Computer and communications security
Containment of network worms via per-process rate-limiting

Proceedings of the 4th international conference on Security and privacy in communication netowrks
Eureka: A Framework for Enabling Static Malware Analysis

ESORICS '08 Proceedings of the 13th European Symposium on Research in Computer Security: Computer Security
An Abstract Interpretation-Based Framework for Control Flow Reconstruction from Binaries

VMCAI '09 Proceedings of the 10th International Conference on Verification, Model Checking, and Abstract Interpretation
A Multi-Application Smart Card System with Authentic Post-Issuance Program Modification

IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences
Executable Code Recognition in Network Flows Using Instruction Transition Probabilities

IEICE - Transactions on Information and Systems
A Visualization Technique for Installation Evidences Containing Malicious Executable Files Using Machine Language Sequence

Information Security Applications
Reconstructing a Packed DLL Binary for Static Analysis

ISPEC '09 Proceedings of the 5th International Conference on Information Security Practice and Experience
Hardening Botnet by a Rational Botmaster

Information Security and Cryptology
Detecting code clones in binary executables

Proceedings of the eighteenth international symposium on Software testing and analysis
A New Approach to Malware Detection

ISA '09 Proceedings of the 3rd International Conference and Workshops on Advances in Information Security and Assurance
How Good Are Malware Detectors at Remediating Infected Systems?

DIMVA '09 Proceedings of the 6th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
The user is not the enemy: fighting malware by tracking user intentions

Proceedings of the 2008 workshop on New security paradigms
Automated Spyware Collection and Analysis

ISC '09 Proceedings of the 12th International Conference on Information Security
Malicious web content detection by machine learning

Expert Systems with Applications: An International Journal
Using spatio-temporal information in API calls with machine learning algorithms for malware detection

Proceedings of the 2nd ACM workshop on Security and artificial intelligence
Metamorphic malware detection technology based on aggregating emerging patterns

Proceedings of the 2nd International Conference on Interaction Sciences: Information Technology, Culture and Human
Automatic Generation of String Signatures for Malware Detection

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Identification of Malicious Web Pages by Inductive Learning

WISM '09 Proceedings of the International Conference on Web Information Systems and Mining
Design of effective anti-malware system for mobile industrial devices based on windows CE

ICACT'09 Proceedings of the 11th international conference on Advanced Communication Technology - Volume 3
A parameter-free hybrid clustering algorithm used for malware categorization

ASID'09 Proceedings of the 3rd international conference on Anti-Counterfeiting, security, and identification in communication
Verification across intellectual property boundaries

CAV'07 Proceedings of the 19th international conference on Computer aided verification
Improving the efficiency of dynamic malware analysis

Proceedings of the 2010 ACM Symposium on Applied Computing
Detecting metamorphic malwares using code graphs

Proceedings of the 2010 ACM Symposium on Applied Computing
Automated classification and analysis of internet malware

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
A forced sampled execution approach to kernel rootkit identification

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Using verification technology to specify and detect malware

EUROCAST'07 Proceedings of the 11th international conference on Computer aided systems theory
Windows vault: prevention of virus infection and secret leakage with secure OS and virtual machine

WISA'07 Proceedings of the 8th international conference on Information security applications
Malware obfuscation detection via maximal patterns

IITA'09 Proceedings of the 3rd international conference on Intelligent information technology application
Can we certify systems for freedom from malware

Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering - Volume 2
Malicious shellcode detection with virtual memory snapshots

INFOCOM'10 Proceedings of the 29th conference on Information communications
Digging for data structures

OSDI'08 Proceedings of the 8th USENIX conference on Operating systems design and implementation
Effective and efficient malware detection at the end host

SSYM'09 Proceedings of the 18th conference on USENIX security symposium
Malware detection using assembly code and control flow graph optimization

Proceedings of the 1st Amrita ACM-W Celebration on Women in Computing in India
AccessMiner: using system-centric models for malware protection

Proceedings of the 17th ACM conference on Computer and communications security
Mimimorphism: a new approach to binary code obfuscation

Proceedings of the 17th ACM conference on Computer and communications security
Modelling metamorphism by abstract interpretation

SAS'10 Proceedings of the 17th international conference on Static analysis
Take a deep breath: a stealthy, resilient and cost-effective botnet using skype

DIMVA'10 Proceedings of the 7th international conference on Detection of intrusions and malware, and vulnerability assessment
Automatic discovery of parasitic malware

RAID'10 Proceedings of the 13th international conference on Recent advances in intrusion detection
Network intrusion detection with semantics-aware capability

IPDPS'06 Proceedings of the 20th international conference on Parallel and distributed processing
Behavior abstraction in malware analysis

RV'10 Proceedings of the First international conference on Runtime verification
A malware detection algorithm based on multi-view fusion

ICONIP'10 Proceedings of the 17th international conference on Neural information processing: models and applications - Volume Part II
Misleading malware similarities analysis by automatic data structure obfuscation

ISC'10 Proceedings of the 13th international conference on Information security
Deriving common malware behavior through graph clustering

Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security
On detecting active worms with varying scan rate

Computer Communications
Recovering the toolchain provenance of binary code

Proceedings of the 2011 International Symposium on Software Testing and Analysis
A method for detecting machine-generated malware

Proceedings of the 49th Annual Southeast Regional Conference
Malware analysis with tree automata inference

CAV'11 Proceedings of the 23rd international conference on Computer aided verification
Who wrote this code? identifying the authors of program binaries

ESORICS'11 Proceedings of the 16th European conference on Research in computer security
deRop: removing return-oriented programming from malware

Proceedings of the 27th Annual Computer Security Applications Conference
Detecting self-mutating malware using control-flow graph matching

DIMVA'06 Proceedings of the Third international conference on Detection of Intrusions and Malware & Vulnerability Assessment
Graph based signature classes for detecting polymorphic worms via content analysis

Computer Networks: The International Journal of Computer and Telecommunications Networking
Malware: from modelling to practical detection

ICDCIT'10 Proceedings of the 6th international conference on Distributed Computing and Internet Technology
Identifying native applications with high assurance

Proceedings of the second ACM conference on Data and Application Security and Privacy
Host-Based security sensor integrity in multiprocessing environments

ISPEC'10 Proceedings of the 6th international conference on Information Security Practice and Experience
Using purpose capturing signatures to defeat computer virus mutating

ISPEC'10 Proceedings of the 6th international conference on Information Security Practice and Experience
Idea: opcode-sequence-based malware detection

ESSoS'10 Proceedings of the Second international conference on Engineering Secure Software and Systems
A probabilistic diffusion scheme for anomaly detection on smartphones

WISTP'10 Proceedings of the 4th IFIP WG 11.2 international conference on Information Security Theory and Practices: security and Privacy of Pervasive Systems and Smart Devices
A signature scheme for distributed executions based on control flow analysis

SIIS'11 Proceedings of the 2011 international conference on Security and Intelligent Information Systems
A cuckoo's egg in the malware nest on-the-fly signature-less malware analysis, detection, and containment for large networks

LISA'11 Proceedings of the 25th international conference on Large Installation System Administration
Pushdown model checking for malware detection

TACAS'12 Proceedings of the 18th international conference on Tools and Algorithms for the Construction and Analysis of Systems
Shadow attacks: automatically evading system-call-behavior based malware detection

Journal in Computer Virology
Quantitative analysis for privacy leak software with privacy Petri net

Proceedings of the ACM SIGKDD Workshop on Intelligence and Security Informatics
A quantitative study of accuracy in system call-based malware detection

Proceedings of the 2012 International Symposium on Software Testing and Analysis
Recognizing malicious software behaviors with tree automata inference

Formal Methods in System Design
Detecting system emulators

ISC'07 Proceedings of the 10th international conference on Information Security
A practical approach for detecting executable codes in network traffic

APNOMS'07 Proceedings of the 10th Asia-Pacific conference on Network Operations and Management Symposium: managing next generation networks and services
Down to the bare metal: using processor features for binary analysis

Proceedings of the 28th Annual Computer Security Applications Conference
In-execution dynamic malware analysis and detection by mining information in process control blocks of Linux OS

Information Sciences: an International Journal
Opcode sequences as representation of executables for data-mining-based unknown malware detection

Information Sciences: an International Journal
LTL model-checking for malware detection

TACAS'13 Proceedings of the 19th international conference on Tools and Algorithms for the Construction and Analysis of Systems
Using file relationships in malware classification

DIMVA'12 Proceedings of the 9th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
ADAM: an automatic and extensible platform to stress test android anti-virus systems

DIMVA'12 Proceedings of the 9th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
DroidChameleon: evaluating Android anti-malware against transformation attacks

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security
Covert computation: hiding code in code for obfuscation purposes

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security
Obfuscated malware detection using API call dependency

Proceedings of the First International Conference on Security of Internet of Things
PoMMaDe: pushdown model-checking for malware detection

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering
VILO: a rapid learning nearest-neighbor classifier for malware triage

Journal in Computer Virology
Detecting machine-morphed malware variants via engine attribution

Journal in Computer Virology
Security and protection of SCADA: a bigdata algorithmic approach

Proceedings of the 6th International Conference on Security of Information and Networks
Simseer and bugwise: web services for binary-level software similarity and defect detection

AusPDC '13 Proceedings of the Eleventh Australasian Symposium on Parallel and Distributed Computing - Volume 140
MAIL: Malware Analysis Intermediate Language: a step towards automating and optimizing malware detection

Proceedings of the 6th International Conference on Security of Information and Networks
DroidLegacy: Automated Familial Classification of Android Malware

Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop 2014
Analyzing program dependencies for malware detection

Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop 2014
A malicious behavior analysis based Cyber-I birth

Journal of Intelligent Manufacturing

Quantified Score

Hi-index	0.00

Visualization

Abstract

A malware detector is a system that attempts to determine whether a program has malicious intent. In order to evade detection, malware writers (hackers) frequently use obfuscation to morph malware. Malware detectors that use a pattern-matching approach (such as commercial virus scanners) are susceptible to obfuscations used by hackers. The fundamental deficiency in the pattern-matching approach to malware detection is that it is purely syntactic and ignores the semantics of instructions. In this paper, we present a malware-detection algorithm that addresses this deficiency by incorporating instruction semantics to detect malicious program traits. Experimental evaluation demonstrates that our malware-detection algorithm can detect variants of malware with a relatively low run-time overhead. Moreover, our semantics-aware malware detection algorithm is resilient to common obfuscations used by hackers.