Malware phylogeny generation using permutations of code

Abstract

Malicious programs, such as viruses and worms, are frequently related to previous programs through evolutionary relationships. Discovering those relationships and constructing a phylogeny model is expected to be helpful for analyzing new malware and for establishing a principled naming scheme. Matching permutations of code may help build better models in cases where malware evolution does not keep things in the same order. We describe methods for constructing phylogeny models that uses features called n-perms to match possibly permuted codes. An experiment was performed to compare the relative effectiveness of vector similarity measures using n-perms and n-grams when comparing permuted variants of programs. The similarity measures using n-perms maintained a greater separation between the similarity scores of permuted families of specimens versus unrelated specimens. A subsequent study using a tree generated through n-perms suggests that phylogeny models based on n-perms may help forensic analysts investigate new specimens, and assist in reconciling malware naming inconsistencies.

Who Wrote This Code? Identifying the Authors of Program Binaries

“…for authorship attribution, due to two factors. First, there are fewer programs per author (4-7) than in the other data sets (8)(9)(10)(11)(12)(13)(14)(15)(16), making this a fundamentally harder learning problem. More importantly, the programs in this data set do not reflect only the work of individual programmers; students in the course were often provided with substantial amounts of partially implemented skeleton code, and also worked closely with the course professor follow an often rigid specification at the sub-module level.…”

“…The instruction-level features we use are similar to those used in malware classification [2,8,9], particularly n-grams; our idiom features differ from features based on instruction sequences through the use of wildcards and the abstraction of low-level details like the opcode and immediate values The instruction summary colors we use in the graphlet features are inspired by a technique to identify polymorphic malware variants [11]. Although some of the binary code representations we use are similar to existing work, our techniques are largely orthogonal: malware classification seeks to extract characteristics specific to a program or a family of programs with related behavior, while our authorship attribution techniques must discover more general properties of author style.…”

Detecting and Classifying Morphed Malwares: A Survey

“…In their proposed work, authors [34] and [35] detected morphed malware variants using a rewriting engine. Syntactic and semantic structure of variants program was analysed.…”

Inferring Phylogenetic Network of Malware Families Based on Splits Graph

“…Previous researches of malware phylogeny inference mainly focused on tree-based model [1]- [6]. Karim et al [1] used the UPGMA algorithm to generate phylogeny trees.…”

“…Karim et al [1] used the UPGMA algorithm to generate phylogeny trees. Gupta et al [6] proposed graph pruning techniques to establish phylogeny trees of malcode based on temporal informations.…”