Architecture of a Morphological Malware DetectorReportar como inadecuado




Architecture of a Morphological Malware Detector - Descarga este documento en PDF. Documentación en PDF para descargar gratis. Disponible también para leer online.

1 CARTE - Theoretical adverse computations, and safety Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods

Abstract : Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs CFG. We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.

Keywords : malware detection control flow graph signature mutations





Autor: Guillaume Bonfante - Matthieu Kaczmarek - Jean-Yves Marion -

Fuente: https://hal.archives-ouvertes.fr/



DESCARGAR PDF




Documentos relacionados