Behavior Analysis of Malware by Rewriting-based Abstraction - Extended Version - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Rapport (Rapport De Recherche) Année : 2011

Behavior Analysis of Malware by Rewriting-based Abstraction - Extended Version

Résumé

We propose a formal approach for the detection of high-level program behaviors. These behaviors, defined as combinations of patterns in a signature, are detected by model-checking on abstracted forms of program traces. Our approach works on unbounded sets of traces, which makes our technique useful not only for dynamic analysis, considering one trace at a time, but also for static analysis, considering a set of traces inferred from a control flow graph. Our technique uses a rewriting-based abstraction mechanism, producing a high-level representation of the program behavior, independent of the program implementation. It allows us to handle similar behaviors in a generic way and thus to be robust with respect to variants. Successfully applied to malware detection, our approach allows us in particular to model and detect information leak.
Fichier principal
Vignette du fichier
fmcad-extended.pdf (256.03 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

inria-00594396 , version 1 (20-05-2011)

Identifiants

  • HAL Id : inria-00594396 , version 1

Citer

Philippe Beaucamps, Isabelle Gnaedig, Jean-Yves Marion. Behavior Analysis of Malware by Rewriting-based Abstraction - Extended Version. [Research Report] 2011. ⟨inria-00594396⟩
246 Consultations
134 Téléchargements

Partager

Gmail Facebook X LinkedIn More