A Categorical Treatment of Malicious Behavioral Obfuscation - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2014

A Categorical Treatment of Malicious Behavioral Obfuscation


This paper studies malicious behavioral obfuscation through the use of a new abstract model for process and kernel interactions based on monoidal categories. In this model, program observations are consid-ered to be finite lists of system call invocations. In a first step, we show how malicious behaviors can be obfuscated by simulating the observa-tions of benign programs. In a second step, we show how to generate such malicious behaviors through a technique called path replaying and we extend the class of captured malwares by using some algorithmic transformations on morphisms graphical representation. In a last step, we show that all the obfuscated versions we obtained can be used to detect well-known malwares in practice.
Fichier principal
Vignette du fichier
paper48-Ta-Pechoux.pdf (750.39 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-01084041 , version 1 (18-11-2014)



Romain Péchoux, Thanh Dinh Ta. A Categorical Treatment of Malicious Behavioral Obfuscation. TAMC 2014, Apr 2014, Chennai, India. pp.280 - 299, ⟨10.1007/978-3-319-06089-7_20⟩. ⟨hal-01084041⟩
76 View
282 Download



Gmail Facebook Twitter LinkedIn More