Morphological detection of malware

Abstract

In the field of malware detection, method based on syntactical consideration are usually efficient. However, they are strongly vulnerable to obfuscation techniques. This study proposes an efficient construction of a morphological malware detector based on a syntactic and a semantic analysis, technically on control flow graphs of programs (CFG). Our construction employs tree automata techniques to provide an efficient representation of the CFG database. Next, we deal with classic obfuscation of programs by mutation using a generic graph rewriting engine. Finally, we carry out experiments to evaluate the false-positive ratio of the proposed methods.

Code synchronization by morphological analysis

“…It can be used in various contexts such as virus detection [4] or libraries identification [3].In the present paper, we describe how morphological analysis can be used to resynchronize addresses in binary codes. We provide here only the main steps of morphological analysis.…”

XSS-Dec: A Hybrid Solution to Mitigate Cross-Site Scripting Attacks

“…CFGs have been often successfully used in static analysis [13,5]. However, given the complexity of certain pages, CFGs can be computationally expensive to generate, and hard to navigate.…”

“…We borrowed the idea of using control flow analysis from some recent interesting work [9,21,5,6]. The Swaddler system [9], for example, focuses on detecting any violations in the workflow of a stateful application or input violations by users.…”

“…Further, our solution accounts for both stateful and stateless applications. Bonfante et al in [5] used control flow graphs for extracting malware signatures. The authors present a system for extracting signatures of malware by using CFGs composed at the assembly language instruction set level.…”

Classification System for Malware Identification and Detection

“…In one month amid 2007, 79% of recognized malware was packed [7]. Also, very nearly half of new malware in 2006 were repacked forms of existing malware [7] [8].This article has been acknowledged for distribution in a future issue of this diary, yet has not been completely altered. Substance may change preceding last distribution.…”