Proposed classification of malware, based on obfuscation

Barría, Cristian Ignacio Vidal; Cordero, David; Cubillos, Claudio; Palma, Miguel

doi:10.1109/icccc.2016.7496735

Cited by 11 publications

(12 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The process of detecting malware through the recognition of their signatures, that these are later saved into the antivirus databases. However, through an updating process, these malware could be transformed and become undetectable without losing its functionality as it is described by Barría et al [4].…”

Section: Current Malware Updating Processmentioning

confidence: 99%

“…Malware is a malicious program that provides access to a system without user's authorization and executes undesirable actions. The terms malware and virus are usually used as the same concept, although they are, in fact, different [4] [19]. Initially, the use of malware was strictly associated with the investigation and protection of software developers for intellectual property (using cryptography), but throughout time its objective changed, and therefore, its importance.…”

Section: Introductionmentioning

confidence: 99%

“…As the malware updating process is generally performed manually, an automatic solution is to be introduced so to compare both in terms of time and costs. This research, an extended version of a previous work [4], provides a proposal of malware classification based on obfuscation. The novelty of the present work relies on; first, providing a summary of the obfuscation-based malware classification tackled in the previous work [4]; second, formalizing the malware update process and making an empirical demonstration on how a malware, that is detectable by antiviruses, could be reused by updating it and making it undetectable through obfuscation; third, comparing the manual and the automated methods for malware updating though an example.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Obfuscation-based Malware Update: A comparison of Manual and Automated Methods

Barría

Cordero

Cubillos

et al. 2017

INT J COMPUT COMMUN

Self Cite

View full text Add to dashboard Cite

This research presents a proposal of malware classification and its update based on capacity and obfuscation. This article is an extension of [4]a, and describes the procedure for malware updating, that is, to take obsolete malware that is already detectable by antiviruses, update it through obfuscation techniques and thus making it undetectable again. As the updating of malware is generally performed manually, an automatic solution is presented together with a comparison from the standpoint of cost and processing time. The automated method proved to be more reliable, fast and less intensive in the use of resources, specially in terms of antivirus analysis and malware functionality checking times.

show abstract

Section: Current Malware Updating Processmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Obfuscation-based Malware Update: A comparison of Manual and Automated Methods

Barría

Cordero

Cubillos

et al. 2017

INT J COMPUT COMMUN

Self Cite

View full text Add to dashboard Cite

show abstract

“…One of the obfuscation methods is adding the dead code that alters the look of the program code. e implementation of this method is easy, but the disadvantage of this approach is that it is recognized by eliminating additional commands [2][3][4][5].…”

Section: Introductionmentioning

confidence: 99%

“…Displacement and handling of the subroutine is one obfuscation method: its advantage is that it obfuscates the source of the program code and downs the order of the subroutine. e disadvantage of this method is that the code is detected by changing the subroutine [1,2].…”

Section: Introductionmentioning

confidence: 99%

Hybrid Obfuscation Using Signals and Encryption

Hashemzade

Maroosi

2018

Journal of Computer Networks and Communications

View full text Add to dashboard Cite

Obfuscation of software and data is one of the subcategories of software security. Hence, the outlines of the obfuscation problem and its various methods have been studied in this article. This paper proposes a hybrid of two signals and encryption obfuscation to hide the behaviour program and prevent reconstruction of the normal code by hackers. The usual signal method is strong enough for obfuscation, but its problem is the high complexity because of a lot of call and return instructions. In this study, a new dispatcher was added to the source code to reconstruct the original control flow graph from the hidden one to solve the problem of the signal method. This dispatcher code is encrypted to preclude access by the hacker. In this paper, the potency that makes the obfuscation strong has been increased and the resilience that makes the obfuscation poor has been decreased. The results of a comparison of the similarity among the ambiguous data with its original code and with available efficient methods present a performance advantage of the proposed hybrid obfuscation algorithm.

show abstract