Malware detection using assembly code and control flow graph optimization

Abstract

Malware detection is a crucial aspect of software security. A malware detector is a system that attempts to determine whether a program has malicious intent. Current malware detectors work by checking for signatures, which attempt to capture the syntactic characteristics of the machine level byte sequence of the malware. This syntactic approach makes current detectors vulnerable to code obfuscations, increasingly used by malware writers that alter the syntactic properties of the malware byte sequence without significantly affecting their execution behavior. This paper derives from the idea that the key to malware identification lies in their syntactic as well as semantic features. It explains an approach using control flow graphs (CFG) for malware detectors . We present an architecture for detecting malicious patterns in executables that is resilient to common obfuscation transformations.

A framework for metamorphic malware analysis and real-time detection

“…Current techniques (Eskandari and Hashemi, 2012a, b;Anju et al, 2010;Song and Touili, 2012a;Vinod et al, 2009;Bruschi et al, 2006;Cesare and Xiang, 2011;Guo et al, 2010;Kirda et al, 2006;Flake, 2004) that use CFG for malware detection are either compute intensive or have poor detection rates and cannot handle malware with smaller CFGs. We propose, in this paper, a new technique named Annotated Control Flow Graph (ACFG) that can enhance the detection of metamorphic malware and can handle malware with smaller CFGs.…”

Program Slicing using Test Cases

“…(3) printf("enter the number of element"); (4) scanf("%d",&n); (5) printf("enter the elements in sorted order"); (6) for(i=0;i<n;i++) (7) scanf("%d",&a[i]); (8) printf("enter the number to be searched"); (9) scanf("%d",&item); (10) (13) mid=((low+high)/2); (14) if(item==a[mid]) { (15) printf("search is successful"); (16) loc=mid; (17) printf("\n loc of item is%d",loc+1); } (18) elseif(item<a…”

Finding contextual clues to malware using a large corpus

“…Most methods rely on signature checking [1,2,3] or behavioral analysis [4,5]. The major disadvantages of signature checking are that clever malware authors can vary their code to have new signatures, and totally new malware cannot be recognized.…”