Static Analysis of Executables to Detect Malicious Patterns

Abstract

Malicious code detection is a crucial component of any defense mechanism. In this paper, we present a unique viewpoint on malicious code detection. We regard malicious code detection as an obfuscation-deobfuscation game between malicious code writers and researchers working on malicious code detection. Malicious code writers attempt to obfuscate the malicious code to subvert the malicious code detectors, such as anti-virus software. We tested the resilience of three commercial virus scanners against code-obfuscation attacks. The results were surprising: the three commercial virus scanners could be subverted by very simple obfuscation transformations! We present an architecture for detecting malicious patterns in executables that is resilient to common obfuscation transformations. Experimental results demonstrate the efficacy of our prototype tool, SAFE (a static analyzer for executables).

Android Mobile Platform Security and Malware Survey

“…Traditional static analysis approaches such as [38], [46], which focus on comparing programs with known malware based on the program code, looking for signatures using other heuristics. Other approaches [47], [48], [49] focus on using machine learning and data mining approaches for malware detection.…”

A Fast Static Analysis Approach to Detect Exploit Code Inside Network Flows

“…Christodorescu et al reported that even basic obfuscation techniques [11] can cause anti-virus scanners to miss malicious code. They go on to describe a technique to counter these code transformation using general representations of commonly occurring virus patterns.…”

“…Origins of a vulnerability can be traced back to bugs in software, which programming language security approaches attempt to detect automatically. [37,10]. However, due to technical difficulties involved in static analysis of programs [25,32], not all bugs can be found and eliminated.…”

Novel FPGA-Based Signature Matching for Deep Packet Inspection

“…Thus, robust NID systems should handle rule updates (including additions) without taking them off-line. Signature/pattern matching is also relevant to virus detection based on the presence of specific command sequences in a program [21]; new signatures are added almost daily. The majority of deep packet inspection systems that try to identify malicious signatures employ pattern matching software running on general-purpose processors.…”