On callgraphs and generative mechanisms

Abstract

This paper examines the structural features of callgraphs. The sample consisted of 120 malicious and 280 non-malicious executables. Pareto models were fitted to indegree, outdegree and basic block count distribution, and a statistically significant difference shown for the derived power law exponent. A two-step optimization process involving human designers and code compilers is proposed to account for these structural features of executables.

Malware detection: program run length against detection rate

“…While the maximum detection rate with the lowest false negative is achieved for the longest program run‐lengths, a good detection rate with an acceptable false negative rate is obtained with ‘logic and arithmetic’ opcodes with a program run length of 1 K. This is consistent with present understanding of malware in that, in the early stages of start‐up, it needs to unpack or decipher the executable code. Bilar et al [3] show that the structure complexity of malware is less than that of non‐malicious software, which has been borne out by the finding produced by the SVM. Fig. 5 presents the data in a format that – The opcodes used for the maximum detection are summed across all the different program run‐lengths and weighted with their respective percentage detection rates.…”

“…In another research, Bilar [3] compared the statically generated CFG of benign and malicious code. His findings showed a difference in the basic block count for benign and malicious code.…”

“…Prior to implementing a classifier, attributes are extracted from the raw data to create meaningful information in the form of features that can be used to train the classifier so that it can successfully predict the classifications of unknown samples. Bilar [3] have shown that a difference in structure between benign and malicious software exists. Therefore, the hypothesis is that this structural difference is present in the opcode population density.…”

“…Therefore, representing a program as a set of instructions; where a program trace p can be defined as a sequence of instructions I and n is the number of instructions A program instruction is a 2‐tuple composed of an opcode and one or more operands. Opcodes are significant in themselves [3] and therefore the operand component of the instruction is discarded.…”

Visualization techniques for malware behavior analysis

“…Bilar 16 analyzes the struct of malware and goodware callgraphs regarding some properties, such as amount of normal internal function calls, amount of calls to external functions statically (libraries) or dynamically (imports) and amount of thunks (usually function envelopes). The results are presented in a statistical way and with several scatter-plots where each point color is proportional to the executable file size.…”