Behavior Analysis of Malware by Rewriting-based Abstraction - Extended Version - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Reports (Research Report) Year : 2011

Behavior Analysis of Malware by Rewriting-based Abstraction - Extended Version

Abstract

We propose a formal approach for the detection of high-level program behaviors. These behaviors, defined as combinations of patterns in a signature, are detected by model-checking on abstracted forms of program traces. Our approach works on unbounded sets of traces, which makes our technique useful not only for dynamic analysis, considering one trace at a time, but also for static analysis, considering a set of traces inferred from a control flow graph. Our technique uses a rewriting-based abstraction mechanism, producing a high-level representation of the program behavior, independent of the program implementation. It allows us to handle similar behaviors in a generic way and thus to be robust with respect to variants. Successfully applied to malware detection, our approach allows us in particular to model and detect information leak.
Fichier principal
Vignette du fichier
fmcad-extended.pdf (256.03 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

inria-00594396 , version 1 (20-05-2011)

Identifiers

  • HAL Id : inria-00594396 , version 1

Cite

Philippe Beaucamps, Isabelle Gnaedig, Jean-Yves Marion. Behavior Analysis of Malware by Rewriting-based Abstraction - Extended Version. [Research Report] 2011. ⟨inria-00594396⟩
242 View
134 Download

Share

Gmail Facebook X LinkedIn More