Fast Flow Analysis with Godel Hashes

Liang, Shuying; Sun, Weibin; Might, Matthew

doi:10.1109/scam.2014.40

Cited by 10 publications

(3 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Their features focused primarily on binary strings, but can be extended by the development of a custom hashing function. Liang et al applied partial order preserving hashing via Gödel hashes to obtain an increase in algorithm performance on existing benchmarks for program flow analysis [20,21].…”

Section: Background and Related Workmentioning

confidence: 99%

Search and Retrieval in Semantic-Structural Representations of Novel Malware

Musgrave,

Campan,

Messay-Kebede

et al. 2024

AAIML

View full text Add to dashboard Cite

In this study, we present a novel representation for binary programs which captures semantic similarity and structural properties. This representation enables the search and retrieval of binary executable programs based on their similarity of behavioral properties. The proposed representation is composed in a bottom-up approach: we begin by extracting data dependency graphs (DDG), which are representative of both program structure and operational semantics. We then encode each program as a set of graph hashes representing isomorphic uniqueness, a method we have labeled DDG Fingerprinting. We present experimental results of search using k-Nearest Neighbors in a metric space constructed from a set of binary executables. Searches in the dataset are based on the operational semantics of specific malware examples By quantifying behavioral similarity we show that we can recognize patterns of operation in novel malware with functionality not previously identified. We show in addition that the associated metric space allows an adjustable level of resolution. Resolution of the features may be decreased for breadth of search and retrieval, or as the search space is reduced, the resolution may be increased for accuracy and fine-grained analysis of malware behavior. This allows for explainability in the interpretation of fine-grained analysis.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Search and Retrieval in Semantic-Structural Representations of Novel Malware

Musgrave,

Campan,

Messay-Kebede

et al. 2024

AAIML

View full text Add to dashboard Cite

show abstract

“…Studies closer to the one performed in this paper, such as [14,26] try to directly classify an application as malicious or benign through permission request analysis for application installation [8], or control ow analysis [18]. ese works take di erent approaches in both the feature extraction and the classi cation phase.…”

Section: Related Workmentioning

confidence: 99%

Android Malware Detection Based on Factorization Machine

Mills

Niu

et al. 2019

IEEE Access

View full text Add to dashboard Cite

As the popularity of Android smart phones has increased in recent years, so too has the number of malicious applications. Due to the potential for data the mobile phone users face, the detection of malware on Android devices has become an increasingly important issue in cyber security. Traditional methods like signature-based routines are unable to protect users from the ever-increasing sophistication and rapid behavior changes in new types of Android malware. erefore, a great deal of e ort has been made recently to use machine learning models and methods to characterize and generalize the malicious behavior pa erns of mobile apps for malware detection.In this paper, we propose a novel and highly reliable classi er for Android Malware detection based on a Factorization Machine architecture and the extraction of Android app features from manifest les and source code. Our results indicate that the numerical feature representation of an app typically results in a long and highly sparse vector and that the interactions among di erent features are critical to revealing malicious behavior pa erns. A er performing an extensive performance evaluation, our proposed method achieved a test result of 100.00% precision score on the DREBIN dataset and 99.22% precision score with only 1.10% false positive rate on the AMD dataset. ese metrics match the performance of state-of-the-art machine-learning-based Android malware detection methods and several commercial antivirus engines with the bene t of training up to 50 times faster.

show abstract

“…Second, WALA has been significantly optimized by the IBM research lab, particularly with underlying Java (collection) libraries rewritten specifically for its framework. Our implementation is based on Scala's default data structures and our specialized Gödel hashing data structure [23]. Last but not least, the analysis time is reasonably acceptable, given the high precision that our analysis technique can provide.…”

Section: Analysis Timementioning

confidence: 99%

Pruning, Pushdown Exception-Flow Analysis

Liang

Sun

Might

et al. 2014

2014 IEEE 14th International Working Conference on Source Code Analysis and Manipulation

Self Cite

View full text Add to dashboard Cite

Statically reasoning in the presence of exceptions and about the effects of exceptions is challenging: exception-flows are mutually determined by traditional control-flow and points-to analyses. We tackle the challenge of analyzing exception-flows from two angles. First, from the angle of pruning control-flows (both normal and exceptional), we derive a pushdown framework for an object-oriented language with full-featured exceptions. Unlike traditional analyses, it allows precise matching of throwers to catchers. Second, from the angle of pruning points-to information, we generalize abstract garbage collection to object-oriented programs and enhance it with liveness analysis. We then seamlessly weave the techniques into enhanced reachability computation, yielding highly precise exception-flow analysis, without becoming intractable, even for large applications. We evaluate our pruned, pushdown exception-flow analysis, comparing it with an established analysis on large scale standard Java benchmarks. The results show that our analysis significantly improves analysis precision over traditional analysis within a reasonable analysis time.Comment: 14th IEEE International Working Conference on Source Code Analysis and Manipulatio

show abstract

Fast Flow Analysis with Godel Hashes

Cited by 10 publications

References 21 publications

Search and Retrieval in Semantic-Structural Representations of Novel Malware

Search and Retrieval in Semantic-Structural Representations of Novel Malware

Android Malware Detection Based on Factorization Machine

Pruning, Pushdown Exception-Flow Analysis

Contact Info

Product

Resources

About