Modelling Metamorphism by Abstract Interpretation

Abstract

Abstract. Metamorphic malware apply semantics-preserving transformations to their own code in order to foil detection systems based on signature matching. In this paper we consider the problem of automatically extract metamorphic signatures from these malware. We introduce a semantics for self-modifying code, later called phase semantics, and prove its correctness by showing that it is an abstract interpretation of the standard trace semantics. Phase semantics precisely models the metamorphic code behavior by providing a set of traces of programs which correspond to the possible evolutions of the metamorphic code during execution. We show that metamorphic signatures can be automatically extracted by abstract interpretation of the phase semantics, and that regular metamorphism can be modelled as finite state automata abstraction of the phase semantics.

Developing correct, distributed, adaptive software

“…In the context of adaptive systems this approach is impractical, since the presence of many different objects, which may interact in complex and even unpredictable ways, makes the system difficult to describe and the analysis a daunting task: considering all possible interactions and behaviours, including those which will never happen in the deployed system, could easily produce a combinatorial explosion. A key point to tackle these problems is to define suitable abstract semantics able to capture the structure of programs that change at run-time, taking inspiration from the techniques used for modelling self-modifying/metamorphic malware in [14].…”