Unveiling metamorphism by abstract interpretation of code properties

Abstract

interpretation Program semantics Metamorphic malware detection Self-modifying programs Metamorphic code includes self-modifying semantics-preserving transformations to exploit code diversification. The impact of metamorphism is growing in security and code protection technologies, both for preventing malicious host attacks, e.g., in software diversification for IP and integrity protection, and in malicious software attacks, e.g., in metamorphic malware self-modifying their own code in order to foil detection systems based on signature matching. In this paper we consider the problem of automatically extracting metamorphic signatures from metamorphic code. We introduce a semantics for self-modifying code, later called phase semantics, and prove its correctness by showing that it is an abstract interpretation of the standard trace semantics. Phase semantics precisely models the metamorphic code behavior by providing a set of traces of programs which correspond to the possible evolutions of the metamorphic code during execution. We show that metamorphic signatures can be automatically extracted by abstract interpretation of the phase semantics. In particular, we introduce the notion of regular metamorphism, where the invariants of the phase semantics can be modeled as finite state automata representing the code structure of all possible metamorphic change of a metamorphic code, and we provide a static signature extraction algorithm for metamorphic code where metamorphic signatures are approximated in regular metamorphism.

Gorille sniffs code similarities, the case study of qwerty versus regin

“…The notion of wave that we use is a little bit different to the one introduced by Dalla Preda, Giacobazzi and Debray [9] (called phase). The main advantage of our approach is that waves can be computed on the fly.…”

Learning metamorphic malware signatures from samples

“…In [12] Dalla Preda et al follow the idea of extracting the specification of the metamorphic engine and of the possible code variants, from the metamorphic code analysis. They introduce a semantics for self-modifying code, called phase semantics, and prove its correctness by proving that it is an abstract interpretation of standard trace semantics.…”

“…In particular, they introduce the notion of regular metamorphism, in which the invariants of phase semantics can be modeled as a FSA representing the code structure of all possible metamorphic changes of a metamorphic code. As a matter of fact, the work in [12] can be considered as a general formal framework for modeling malware metamorphism, while our work provides a practical application of the formal framework that allows us to automatically extract the metamorphic signatures as a rewriting rules system.…”

“…We start with a simple case study taken from [12] where the authors manually built the graph accepting all the possible metamorphic variants generated from the following program: [P : mov e, 10] The hidden metamorphic engine applies the following transformation rules: R1 push e 2 ; pop e 1 ↔ mov e 1 ,e 2 R2 mov e 2 , e 1 ; push e 2 ↔ push e 1 R3 pop e 2 ; mov e 1 ,e 2 ↔ pop e 1 Note that, by substituting e with either an immediate value Imm, a register or a memory value, in the above three rules we obtain the first six rules presented in Sect. 5.1 which are implemented in MetaSign.…”

“…The key idea is to build a unique CFG for all the code variants that over-approximates the union of their recognized languages, i.e., it models the metamorphic behavior as a regular language of abstract instructions. This process is called regular metamorphism [12]. Finally, from the resulting widening CFG, MetaSign tries to learn the rewriting rules used to generate each variant through a simple learning grammar technique [13,14] and it produces, as output, the inferred rules.…”