No abstract

Current static malware detection techniques have serious limitations. Little modifications can result in a new strand of malware that escapes. In this paper, we present a static detection technique using disassembly of a malware emphasizing the recognition of variants of a malware in its signature set. The hypothesis is that all variants share a common core signature that is a combination of several features of the code. In addition to malware, spyware and adware are also analyzed to find the similar features. A previously identified malware can be analyzed to extract the signature, which will then be used to recognize its variants. Since this technique uses disassembled code, it can be used on any operating system. Encouraging experimental results on a set of malware are presented. Since the existence of spyware and adware is increasing, an analysis on how this technique can be extended to detect spyware is also presented.

Automatic identification and collection (AIDC) technologies have made the life of a man much easier on numerous platforms. Of the various such technologies the radio frequency identification devices (RFID) have become pervasive essentially because they can track from a greater physical distance than the rest. The back end that supports these RFID systems has always been working well until they encounter a sbadly-formatted RFID tag. There have hardly been any incidents where such tags, once identified by the back-end systems, can in fact wreak havoc via the interacting databases in the RFID infrastructure. Recently, there has been significant research in this area. In the previous work, the author managed to do an attack using a self-referential query on Linux, Oracle, and PHP. However, they have been unable to test it on SQL Server 2005. This paper differs from the previous work in the way that it extends the attack using a self-referential query to Windows, SQL Server 2005, and ASP with their respective latest updates installed. The query itself is more robust by making certain that the table can contain it.

Malware, in essence, is an infiltration to one's computer system. Malware is created to wreak havoc once it gets in through weakness in a computer's barricade. Antivirus companies and operating system companies are working to patch weakness in systems and to detect infiltrators. However, with the advance of fragmentation, detection might even prove to be more difficult. Malware detection relies on signatures to identify malware of certain shapes. With fragmentation, functionality and size can change depending on how many fragments are used and how the fragments are created. In this paper we present a robust malware detection technique, with emphasis on detecting fragmentation malware attacks in RFID systems that can be extended to detect complex obfuscated and mutated malware. After a particular fragmented malware has been first identified, it can be analyzed to extract the signature, which provides a basis for detecting variants and mutants of similar types of malware in the future. Encouraging experimental results on a limited set of recent malware are presented.