Disassembled code analyzer for malware (DCAM)

Abstract

Current static malware detection techniques have serious limitations. Little modifications can result in a new strand of malware that escapes. In this paper, we present a static detection technique using disassembly of a malware emphasizing the recognition of variants of a malware in its signature set. The hypothesis is that all variants share a common core signature that is a combination of several features of the code. In addition to malware, spyware and adware are also analyzed to find the similar features. A previously identified malware can be analyzed to extract the signature, which will then be used to recognize its variants. Since this technique uses disassembled code, it can be used on any operating system. Encouraging experimental results on a set of malware are presented. Since the existence of spyware and adware is increasing, an analysis on how this technique can be extended to detect spyware is also presented.

Accurate Adware Detection Using Opcode Sequence Extraction

“…However, we argue that it is important to detect adware to let users exercise the right to make an informed choice about the software they install. In previous work, opcodes have been used for detection of different variants of worms and some types of spyware [14]. From the original malware, opcodes were extracted and paired with labels.…”

Analyzing WhisperGate and BlackCat Malware: Methodology and Threat Perspective

“…DCAM is a static malware detection technique using code disassembly to recognize malware variants based on a common core signature with promising results on a set of malware [33]. MARE introduced a four-stage approach covering a structured analysis process that focuses on producing an objective outcome to detect malware followed by isolation and extraction phases, as shown by [34], who introduced the malware behavioral technique, malware reverse engineering, and code analysis.…”

Detecting scareware by mining variable length instruction sequences

“…Opcodes have already been used to build signature databases that can be searched to detect different variants of worms [17]. To avoid the problem of having to manually update the databases of the scanners, data mining algorithms were later used as part of a scientific study to build a generic scanner [18].…”

“…These types of malware are typically very distinct from the standard benign software program. Moreover, only a few studies have used only the opcode from the instruction as the feature of choice [17][18] [19]. Today, very little is known about the appropriateness of using opcodes or instruction sequences as features when trying to detect the type of malware that is more similar to benign software in terms of behavior.…”