Tutorial: an Overview of Malware Detection and Evasion Techniques - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2018

Tutorial: an Overview of Malware Detection and Evasion Techniques

Abstract

This tutorial presents and motivates various malware detection tools and illustrates their usage on a clear example. We demonstrate how statically-extracted syntactic signatures can be used for quickly detecting simple variants of malware. Since such signatures can easily be obfuscated, we also present dynamically-extracted behavioral signatures which are obtained by running the malware in an isolated environment known as a sandbox. However, some malware can use sandbox detection to detect that they run in such an environment and so avoid exhibiting their malicious behavior. To counteract sandbox detection, we present concolic execution that can explore several paths of a binary. We conclude by showing how opaque predicates and JIT can be used to hinder concolic execution.
Fichier principal
Vignette du fichier
main.pdf (819 Ko) Télécharger le fichier
Origin Files produced by the author(s)
Loading...

Dates and versions

hal-01964222 , version 1 (21-12-2018)

Identifiers

  • HAL Id : hal-01964222 , version 1

Cite

Fabrizio Biondi, Thomas Given-Wilson, Axel Legay, Cassius Puodzius, Jean Quilbeuf. Tutorial: an Overview of Malware Detection and Evasion Techniques. ISoLA 2018 - 8th International Symposium On Leveraging Applications of Formal Methods, Verification and Validation, Oct 2018, Limassol, Cyprus. pp.1-23. ⟨hal-01964222⟩
395 View
2736 Download

Share

Gmail Mastodon Facebook X LinkedIn More