Abstraction-based Malware Analysis Using Rewriting and Model Checking - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2012

Abstraction-based Malware Analysis Using Rewriting and Model Checking


We propose a formal approach for the detection of high-level malware behaviors. Our technique uses a rewriting-based abstraction mechanism, producing abstracted forms of program traces, independent of the program implementation. It then allows us to handle similar be- haviors in a generic way and thus to be robust with respect to variants. These behaviors, defined as combinations of patterns given in a signa- ture, are detected by model-checking on the high-level representation of the program. We work on unbounded sets of traces, which makes our technique useful not only for dynamic analysis, considering one trace at a time, but also for static analysis, considering a set of traces inferred from a control flow graph. Abstracting traces with rewriting systems on first order terms with variables allows us in particular to model dataflow and to detect information leak.
Fichier principal
Vignette du fichier
esorics-definitif.pdf (239.78 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-00762252 , version 1 (10-12-2012)



Philippe Beaucamps, Isabelle Gnaedig, Jean-Yves Marion. Abstraction-based Malware Analysis Using Rewriting and Model Checking. ESORICS - 17th European Symposium on Research in Computer Security - 2012, Sep 2012, Pisa, Italy. pp.806-823, ⟨10.1007/978-3-642-33167-1⟩. ⟨hal-00762252⟩
291 View
623 Download



Gmail Facebook X LinkedIn More