Architecture of a Morphological Malware Detector - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Journal Articles Journal in Computer Virology Year : 2009

Architecture of a Morphological Malware Detector


Most of malware detectors are based on syntactic signatures that identify known malicious programs. Up to now this architecture has been sufficiently efficient to overcome most of malware attacks. Nevertheless, the complexity of malicious codes still increase. As a result the time required to reverse engineer malicious programs and to forge new signatures is increasingly longer. This study proposes an efficient construction of a morphological malware detector, that is a detector which associates syntactic and semantic analysis. It aims at facilitating the task of malware analysts providing some abstraction on the signature representation which is based on control flow graphs (CFG). We build an efficient signature matching engine over tree automata techniques. Moreover we describe a generic graph rewriting engine in order to deal with classic mutations techniques. Finally, we provide a preliminary evaluation of the strategy detection carrying out experiments on a malware collection.
Fichier principal
Vignette du fichier
flowgraph.pdf (316.92 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

inria-00330022 , version 1 (13-10-2008)



Guillaume Bonfante, Matthieu Kaczmarek, Jean-Yves Marion. Architecture of a Morphological Malware Detector. Journal in Computer Virology, 2009, 5 (3), pp.263-270. ⟨10.1007/s11416-008-0102-4⟩. ⟨inria-00330022⟩
226 View
778 Download



Gmail Facebook X LinkedIn More