Learning metamorphic malware signatures from samples

Abstract

Metamorphic malware are self-modifying programs which apply semantic preserving transformations to their own code in order to foil detection systems based on signature matching. Metamorphism impacts both software security and code protection technologies: it is used by malware writers to evade detection systems based on pattern matching and by software developers for preventing malicious host attacks through software diversification. In this paper, we consider the problem of automatically extracting metamorphic signatures from the analysis of metamorphic malware variants. We define a metamorphic signature as an abstract program representation that ideally captures all the possible code variants that might be generated during the execution of a metamorphic program. For this purpose, we developed MetaSign: a tool that takes as input a collection of metamorphic code variants and produces, as output, a set of transformation rules that could have been used to generate the considered metamorphic variants. MetaSign starts from a control flow graph representation of the input variants and agglomerates them into an automaton which approximates the considered code variants. The upper approximation process is based on the concept of widening automata, while the semantic preserving transformation rules, used by the metamorphic program, can be viewed as rewriting rules and modeled as grammar productions. In this setting, the grammar recognizes the language of code variants, while the production rules model the metamorphic transformations. In particular, we formalize the language of code variants in terms of pure context-free grammars, which are similar to context-free grammars with no terminal symbols. After the widening process, we create a positive set of samples from which we extract the productions of the grammar by applying a learning grammar technique. This allows us to learn the transformation rules used by the metamorphic engine to generate the considered code variants. We validate the results of MetaSign on some case studies.

A Formal Framework to Measure the Incompleteness of Abstract Interpretations

“…Understanding the propagation of incompleteness through pre-metrics is closely linked to code obfuscation [16], which finds application in software protection [28,30,31] and malware analysis [40,44,26,12]. Being able to quantify the amount of incompleteness induced in the abstract interpretation by a codeobfuscating program transformation could enable us to measure the potency of these transformations.…”

SAUCY SPICE: uma nova abordagem eficiente para a detecção de malwares baseada em assinatura

“…Diversos trabalhos anteriores propuseram variadas formas de se gerar regras gerais que, a partir de um conjunto diminuto de amostas, representassem todas as suas variac ¸ões metamórficas ou polimórficas, isto é, aquelas que se automodificam, com base em criptografia ou não, a cada replicac ¸ão, na tentativa de dificultar a identificac ¸ão por soluc ¸ões de seguranc ¸a. [Campion et al 2021, Razeghi Borojerdi and Abadi 2013, Tang et al 2009]. Diferentemente do objetivo do SAUCY SPICE, as regras criadas por tais trabalhos limitam-se a generalizar as variac ¸ões polimórficas ou metamórficas.…”

“…Como resposta a esses desafios, a detecc ¸ão de malwares precisa evoluir no sentido de criar regras pequenas que representem o máximo possível de malwares e de se ter um mecanismo de gerac ¸ão automática de assinaturas [Aslan and Samet 2020]. Nesse sentido, trabalhos anteriores obtiveram êxito em criar mecanismos de gerac ¸ão automática de regras para malwares polimórficos/metamórficos [Campion et al 2021, Razeghi Borojerdi and Abadi 2013, Tang et al 2009]. Outros trabalhos também tiveram sucesso em criar mecanismos de criac ¸ão automática de assinaturas em cenários específicos.…”

Enhanced Metamorphic Techniques-A Case Study Against Havex Malware

“…Formal Grammar Mutation was used for the first time for the formalization of code morphing techniques in [17] and [18]. Recent studies show the use of Formal Grammar to understand the metamorphic malware signature from different code variants [19], [20].…”