Abstraction by Term Rewriting for Malware Behavior Analysis - Extended Version - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Reports (Research Report) Year : 2010

Abstraction by Term Rewriting for Malware Behavior Analysis - Extended Version

Abstract

We propose a formal approach for behavioral analysis of programs based on dynamic analysis. It works by abstracting execution traces with respect to given behavior patterns in order to produce a high level representation of a program behavior and then, by comparing this abstract form to signatures defining reference abstract malicious behaviors. Abstraction is performed by term rewriting using rules on terms with variables, which enables to handle the data used by behavior functionalities. This technique allows us to deal with interleaved behaviors. Successfully applied to malware detection, it allows us in particular to model and detect information leak.
Fichier principal
Vignette du fichier
article-extended.pdf (293.4 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

inria-00547884 , version 1 (17-12-2010)
inria-00547884 , version 2 (19-12-2010)
inria-00547884 , version 3 (05-01-2011)

Identifiers

  • HAL Id : inria-00547884 , version 3

Cite

Philippe Beaucamps, Isabelle Gnaedig, Jean-Yves Marion. Abstraction by Term Rewriting for Malware Behavior Analysis - Extended Version. [Research Report] 2010. ⟨inria-00547884v3⟩
154 View
137 Download

Share

Gmail Facebook X LinkedIn More