No abstract

No abstract

This paper examines the structural features of callgraphs. The sample consisted of 120 malicious and 280 non-malicious executables. Pareto models were fitted to indegree, outdegree and basic block count distribution, and a statistically significant difference shown for the derived power law exponent. A two-step optimization process involving human designers and code compilers is proposed to account for these structural features of executables.

This paper examines the structural features of callgraphs. The sample consisted of 120 malicious and 280 non-malicious executables. Pareto models were fitted to indegree, outdegree and basic block count distribution, and a statistically significant difference shown for the derived power law exponent. A two-step optimization process involving human designers and code compilers is proposed to account for these structural features of executables.

In the beginning, there was bureaucracy. I had tried to get major AV companies to give me malware samples to study in an academic setting, but to no avail: Liability reasons, and their suggestion-trekking back and forth to their corporate 'clean' room-was unpalatable to me. I like flat hierarchies, so I turned to herm1t. Herm1t runs (singlehandedly, with minimal equipment and funds) the labour of love known as vxheavens (http://vx.netlux.org), a full-spectrum site dedicated to computer viruses. As quid pro quo, I sent him historical papers he sought for his collection. One title, though, seemed out of reach: A German 1980 MSc thesis by some fellow named Juergen Kraus. A hefty Dortmund package arrived late October 2006. I was quite pleased. After almost a year of unsuccessful attempts through US academic institutions' Intra Library Loan program, I had the epiphany to contact the computer science librarian at the University of Dortmund, Peter Kleffmann. He managed to locate the sole remaining public copy of the thesis-adding an air of mystery to this trouvaille, it was found stashed away in a vault. I skimmed the thesis :Over two hundred pages on the topic of self-reproducing programs, yet set on a mechanical typewriter, chockfull with hand-edited mathematical formulae and notation, Siemens assembly and SIMULA code. I could not fend off