Partial Evaluation for Java Malware Detection

Abstract

Abstract. The fact that Java is platform independent gives hackers the opportunity to write exploits that can target users on any platform, which has a JVM implementation. To circumvent detection by anti virus (AV) software, obfuscation techniques are routinely applied to make an exploit more difficult to recognise. Popular obfuscation techniques for Java include string obfuscation and applying reflection to hide method calls; two techniques that can either be used together or independently. This paper shows how to apply partial evaluation to remove these obfuscations and thereby improve AV matching. The paper presents a partial evaluator for Jimple, which is a typed three-address code suitable for optimisation and program analysis, and also demonstrates how the residual Jimple code, when transformed back into Java, improves the detection rates of a number of commercial AV products.

Partial Evaluation of Rewriting Logic Theories

“…For instance, in the area of functional programming [Consel and Danvy 1993;Jones et al 1993;Turchin 1986] and logic programming (also known as partial deduction) [Gallagher 1993;Komorowski 1982;Lloyd and Shepherdson 1991;Pettorossi and Proietti 1994]. Also for imperative languages such as C [Consel et al 1998] and Java [Ji and Bubel 2012;Singh and King 2014], and in declarative languages such as Prolog [Leuschel and Bruynooghe 2002], Haskell [Jones 1990], and Curry [Albert et al 1999;Hanus and Peemöller 2014].…”