Hunting for Pirated Software Using Metamorphic Analysis

Rana, Hardikkumar; Stamp, Mark

doi:10.1080/19393555.2014.975557

Cited by 11 publications

(11 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…As malware has become increasingly difficult to detect with traditional techniques, new approaches are needed, and machine learning based tools seem a promising avenue. Hidden Markov models are one such technique that has been used effectively for malware detection in previous work [1,4,19,21,26,31,43]. In contrast, Profile Hidden Markov Models seem to have rarely been studied in this context, with previous results being mixed, at best [3].…”

Section: Discussionmentioning

confidence: 99%

“…Next, we briefly discuss examples of analysis techniques that use static and dynamic birthmarks for malware detection As previously mentioned, static analysis involves analyzing the program without executing it. In [26], static analysis is performed by extracting opcode sequences with the help of a disassembler. The key advantage of static analysis is that it is relatively faster and efficient.…”

Section: Software Birthmarksmentioning

confidence: 99%

“…In this section, we discuss Hidden Markov Models (HMMs) in some detail. HMMs have proven useful in a wide array of fields, including speech recognition [25], malware detection [43], and software piracy analysis [26]. In this paper, we apply HMMs to the problem of malware detection based on software birthmarks.…”

Section: Hidden Markov Modelsmentioning

confidence: 99%

“…If the birthmarks of the two files are sufficiently similar, then we assume that one software is closely related to the other. This strategy has been the basis of a variety of techniques for identifying metamorphic malware with statistical approaches [17,21,23,26,33,34,41,44].…”

mentioning

confidence: 99%

See 3 more Smart Citations

Malware Detection Using Dynamic Birthmarks

Vemparala

Troia

Visaggio

et al. 2016

Proceedings of the 2016 ACM on International Workshop on Security and Privacy Analytics

View full text Add to dashboard Cite

In this paper, we explore the effectiveness of dynamic analysis techniques for identifying malware, using Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs), both trained on sequences of API calls. We contrast our results to static analysis using HMMs trained on sequences of opcodes, and show that dynamic analysis achieves significantly stronger results in many cases. Furthermore, in contrasting our two dynamic analysis techniques, we find that using PHMMs consistently outperforms our analysis based on HMMs. IntroductionNews stories abound about cyber attacks relating to malware. In 2014, Twitter was at the receiving end of a major cyber attack. According to news reports, 250,000 users' email addresses, user names, and passwords were compromised. Twitter was able to detect the attack by identifying the abnormal patterns in which data was accessed [14].Target fell victim to a major security breach during the 2013 holiday season, where credit and debit card details of more than a million customers were compromised. The information was stolen by hacking the credit card swipe systems at Target stores [10]. This one attack drove down quarterly revenues of Target by tens of millions of dollars [11].In today's world of malware and cyber threats, it has become critical to develop techniques that quickly identify malware. In this paper, we look at different malware detection techniques and compare their results.We use the concept of software birthmarks for malware detection. Software birthmarks are inherent characteristics that can be used to identify particular software [23,33]. The goal is to obtain a unique identifier for each executable. We can then use these birthmarks to test the similarity between two executables. If the birthmarks of the two files are sufficiently similar, then we assume that one software is closely related to the other. This strategy has been the basis of a variety of techniques for identifying metamorphic malware with statistical approaches [17,21,23,26,33,34,41,44].

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Software Birthmarksmentioning

confidence: 99%

Section: Hidden Markov Modelsmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Malware Detection Using Dynamic Birthmarks

Vemparala

Troia

Visaggio

et al. 2016

Proceedings of the 2016 ACM on International Workshop on Security and Privacy Analytics

View full text Add to dashboard Cite

show abstract

“…If the two birthmarks are the same, the similarity in the birthmarks implies that one software is a copy of another. Based on this, there has been a lot of research in the field of software birthmarks [12,14,18,21,31,32,35,36].…”

mentioning

confidence: 99%