Annotated Control Flow Graph for Metamorphic Malware Detection

Alam, Shahid; Traoré, Issa; Soğukpınar, İbrahim

doi:10.1093/comjnl/bxu148

Cited by 37 publications

(17 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In this approach, the code is put under observation and approximate runtime behavior/pattern is predicted to detect the malware. In the static approach, many detection mechanisms are proposed such as annotated context-free graph [125], disassembled code [126], portable executable binary code [127] and honeypots [128]. Using this technique dynamic analysis of the malware is difficult to conceal.…”

Section: Malware Detectionmentioning

confidence: 99%

Applications in Security and Evasions in Machine Learning: A Survey

2020

View full text Add to dashboard Cite

In recent years, machine learning (ML) has become an important part to yield security and privacy in various applications. ML is used to address serious issues such as real-time attack detection, data leakage vulnerability assessments and many more. ML extensively supports the demanding requirements of the current scenario of security and privacy across a range of areas such as real-time decision-making, big data processing, reduced cycle time for learning, cost-efficiency and error-free processing. Therefore, in this paper, we review the state of the art approaches where ML is applicable more effectively to fulfill current real-world requirements in security. We examine different security applications’ perspectives where ML models play an essential role and compare, with different possible dimensions, their accuracy results. By analyzing ML algorithms in security application it provides a blueprint for an interdisciplinary research area. Even with the use of current sophisticated technology and tools, attackers can evade the ML models by committing adversarial attacks. Therefore, requirements rise to assess the vulnerability in the ML models to cope up with the adversarial attacks at the time of development. Accordingly, as a supplement to this point, we also analyze the different types of adversarial attacks on the ML models. To give proper visualization of security properties, we have represented the threat model and defense strategies against adversarial attack methods. Moreover, we illustrate the adversarial attacks based on the attackers’ knowledge about the model and addressed the point of the model at which possible attacks may be committed. Finally, we also investigate different types of properties of the adversarial attacks.

show abstract

Section: Malware Detectionmentioning

confidence: 99%

Applications in Security and Evasions in Machine Learning: A Survey

2020

View full text Add to dashboard Cite

show abstract

“…Alam et.al [21] apresentam uma estrutura chamada de Grafo de Controle de Fluxo Anotado (GCFA), construído a partir das funções do código binário de instâncias de malware. Operações comumente utilizadas em código assembly são mapeadas a classes que são utilizadas para anotar os GCFAs.…”

Section: B Comparação De Estruturas Semânticas Em Forma De Grafosunclassified

“…Ainda há dois blocos especiais, o bloco de entrada e o bloco de saída, de onde se começa e termina o fluxo, respectivamente. Formalmente um grafo de controle de fluxo pode ser definido como [21]:…”

Section: Detecção De Malware Metamórfico Usando Gddunclassified

Improving the detection of metamorphic malware through data dependency graphs indexing

Aguilera¹,

Souto²,

Martins³

2018

J. Inf. Secur. Cryptogr.

View full text Add to dashboard Cite

Abstract-Metamorphism have been successfully used in original malicious code to the creation and proliferation of new malware instances, making them harder to detect. This work presents an approach that identifies metamorphic malware through data dependency graphs comparison. Features are extracted on data dependency graphs to build an index that is used to determine which malware family a suspicious code belongs to. Experimental results on 3045 samples of metamorphic malware showed that our proposed approach obtained accuracy rate higher than most commercial anti-malware tools.Index Terms-malware, metamorfismo, grafos de dependência, engenharia reversa, aprendizagem de máquina. I. INTRODUÇÃOApesar dos crescentes investimentos e esforços realizados pelas companhias de segurança na criação de soluções de detecção de software maliciosos (e.g. antivirus, antispyware e adware), a infecção de malware continua sendo uma das principais ameaças a segurança dos sistemas computacionais no mundo. A sofisticação dos ataques e o aumento cada vez maior das famílias de malware tem tornado a defesa contra cibercriminosos uma tarefa ainda mais difícil. De acordo com a empresa AV-Test [2], considerando somente os anos de 2013 e 2014, a quantidade de novas amostras de malware aumentou de 83 para 142 milhões, representando uma taxa de crescimento superiorà 71%. Um relatório produzido pela Symantec descreve um aumento de 274 milhões de amostras de vírus em 2014 para 357 milhões em 2016 [3]. Esses estudos reconhecem a falta de capacidade das ferramentas de detecção de malware existentes em lidar com as técnicas usadas pelos atacantes para evadir tais ferramentas.Essa dificuldade ocorre principalmente porque os criadores de programas maliciosos empregam várias técnicas de evasão como polimorfismo e metamorfismo de código para criar novas variantes de um malware a partir de uma mesma instância de código original, gerando diversas estruturas e padrões de código aleatórios [4]. Tal nível de variedade pode ser obtido de forma automatizada, a uma taxa exponencial, o que torna a criação de modelos de identificação de malware um processo ainda mais difícil.Este artigo corresponde a uma versão estendida do artigo:"Detecção de malware metamórfico baseada na indexação de grafos Dentre as abordagens citadas, o uso de Grafos de Dependência de Dados (GDDs) se apresenta como uma alternativa promissora para detecção de malware metamórficos, visto que as relações semânticas representadas pelos GDDs se mantêm praticamente inalteradas mesmo quando uma nova versão de malwareé criada. Um GDDé uma representação que usa uma notação baseada em grafos para descrever todas as relações de dependências de dados existentes entre as instruções de um programa de computador. Liu et al. [14] e Kim e Moon [13], por exemplo, demonstraram que possível usar GDDs para identificar efetivamente pelo menos cinco tipos diferentes de técnicas de ofuscação de código: i) alteração de formato; ii) mudança no nome das variáveis; iii) reordenamento de estruturas; iv) troca de estr...

show abstract

“…AESA helps to determine the nearest neighbour of the signature tree. Another proposal by Alam et al (2014c) focused on real-time detection that is also platform independent. This was achieved by disassembling and translating the binary program into an intermediate language called Malware Analysis Intermediate Language (MAIL).…”

Section: B Control Flow Graph (Cfg)mentioning

confidence: 99%

“…History of Malware evolution shows that many malicious software were written for fun or testing software behaviour. However, state-ofthe-art malware is also developed for financial gain (Alam et al, 2014c), political influence, enabling anti-social behaviour such as cyberstalking (al-Khateeb et al, 2016), or to sabotaging the defence systems of a country. Consequently, malware coding became extremely sophisticated.…”

Section: Introductionmentioning

confidence: 99%

Effective methods to detect metamorphic malware: a systematic review

Irshad¹,

Al-Khateeb²,

Mansour³

et al. 2018

IJESDF

View full text Add to dashboard Cite

The succeeding code for metamorphic Malware is routinely rewritten to remain stealthy and undetected within infected environments. This characteristic is maintained by means of encryption and decryption methods, obfuscation through garbage code insertion, code transformation and registry modification which makes detection very challenging. The main objective of this study is to contribute an evidence-based narrative demonstrating the effectiveness of recent proposals. Sixteen primary studies were included in this analysis based on a pre-defined protocol. The majority of the reviewed detection methods used Opcode, Control Flow Graph (CFG) and API Call Graph. Key challenges facing the detection of metamorphic malware include code obfuscation, lack of dynamic capabilities to analyse code and application difficulty. Methods were further analysed on the basis of their approach, limitation, empirical evidence and key parameters such as dataset, Detection Rate (DR) and False Positive Rate (FPR).

show abstract

Annotated Control Flow Graph for Metamorphic Malware Detection

Cited by 37 publications

References 34 publications

Applications in Security and Evasions in Machine Learning: A Survey

Applications in Security and Evasions in Machine Learning: A Survey

Improving the detection of metamorphic malware through data dependency graphs indexing

Effective methods to detect metamorphic malware: a systematic review

Contact Info

Product

Resources

About