Behavior Abstraction in Malware Analysis - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2010

Behavior Abstraction in Malware Analysis

Abstract

We present an approach for proactive malware detection by working on an abstract representation of a program behavior. Our technique consists in abstracting program traces, by rewriting given subtraces into abstract symbols representing their functionality. Traces are captured dynamically by code instrumentation in order to handle packed or self-modifying malware. Suspicious behaviors are detected by comparing trace abstractions to reference malicious behaviors. The expressive power of abstraction allows us to handle general suspicious behaviors rather than specific malware code and then, to detect malware mutations. We present and discuss an implementation validating our approach.
Fichier principal
Vignette du fichier
RV-preprint.pdf (433.21 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

inria-00536500 , version 1 (10-10-2018)

Identifiers

Cite

Philippe Beaucamps, Isabelle Gnaedig, Jean-Yves Marion. Behavior Abstraction in Malware Analysis. 1st International Conference on Runtime Verification, Howard Barringer, Klaus Havelund, Insup Lee, Nov 2010, St. Julians, Malta. pp.168-182, ⟨10.1007/978-3-642-16612-9_14⟩. ⟨inria-00536500⟩
283 View
261 Download

Altmetric

Share

Gmail Facebook X LinkedIn More