Mining Malware Specifications through Static Reachability Analysis

Abstract

International audienceAbstract. The number of malicious software (malware) is growing out of control. Syntactic signature based detection cannot cope with such growth and manual construction of malware signature databases needs to be replaced by computer learning based approaches. Currently, a single modern signature capturing the semantics of a malicious behavior can be used to replace an arbitrarily large number of old-fashioned syntactical signatures. However teaching computers to learn such behaviors is a challenge. Existing work relies on dynamic analysis to extract malicious behaviors, but such technique does not guarantee the coverage of all behaviors. To sidestep this limitation we show how to learn malware signatures using static reachability analysis. The idea is to model binary programs using pushdown systems (that can be used to model the stack operations occurring during the binary code execution), use reachability analysis to extract behaviors in the form of trees, and use subtrees that are common among the trees extracted from a training set of malware files as signatures. To detect malware we propose to use a tree automaton to compactly store malicious behavior trees and check if any of the subtrees extracted from the file under analysis is malicious. Experimental data shows that our approach can be used to learn signatures from a training set of malware files and use them to detect a test set of malware that is 5 times the size of the training set

Malicious and Harmless Software in the Domain of System Utilities

“…However, Beaucamps et al addressed this problem in their work [13] and proposed a method for static analysis of execution traces acquired from control-flow graphs. Macedo and Touili also discuss the issue in their work [14].…”

Dynamic VSA: a framework for malware detection based on register contents

“…On the other hand comparing graphs to find the existing similarities between them, is time and space consuming because some of problems are NP-complete (Elhadi et al, 2012;Skaletsky et al, 2010;Macedo and Touili, 2013).…”

“…Model-checking is time consuming and it is not a suitable real-time detector. (Macedo and Touili, 2013) constructed trees statically to find which data flows between functions are only malicious. The trees constructed with system function and parameters that pass to them as nodes.…”

A Cloud-Based Collaboration Platform for Model-Based Design of Cyber-Physical Systems

“…Moreover, the components of the sandbox kernel are open source, e.g. Hypervisor, NFS server, and the security will be based on Data-Service Sovereignty principles, in order to enhance trust among beneficiaries of the HUBCAP Platform (exchanging data and services), but also intended to provide protection mechanisms to prevent the infiltration of malware into the collaboration platform by applying known malware detection techniques, for instance (Macedo and Touili, 2013), which will systematically check the collaboration platform FMUs for malicious behaviour. Furthermore, secure isolation (Suciu et al, 2018) and security information and event management (SIEM) can ensure that aggregated data and log records can be automatically analysed giving a clear picture of what is happening on the platform.…”