loading...
Semantics-Aware Malware Detection
Oakland, California May 08-May 11
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SP.2005.202005 IEEE Symposium on Security and P ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Mihai Christodorescu, University of Wisconsin, Madison
Somesh Jha, University of Wisconsin, Madison
Sanjit A. Seshia, Carnegie Mellon University
Dawn Song, Carnegie Mellon University
Randal E. Bryant, Carnegie Mellon University
A malware detector is a system that attempts to determine whether a program has malicious intent. In order to evade detection, malware writers (hackers) frequently use obfuscation to morph malware. Malware detectors that use a pattern-matching approach (such as commercial virus scanners) are susceptible to obfuscations used by hackers. The fundamental deficiency in the pattern-matching approach to malware detection is that it is purely syntactic and ignores the semantics of instructions. In this paper, we present a malware-detection algorithm that addresses this deficiency by incorporating instruction semantics to detect malicious program traits. Experimental evaluation demonstrates that our malware-detection algorithm can detect variants of malware with a relatively low run-time overhead. Moreover, our semantics-aware malware detection algorithm is resilient to common obfuscations used by hackers.
Citation:
Mihai Christodorescu, Somesh Jha, Sanjit A. Seshia, Dawn Song, Randal E. Bryant, "Semantics-Aware Malware Detection," sp, pp.32-46, 2005 IEEE Symposium on Security and Privacy (S&P'05), 2005
Usage of this product signifies your acceptance of the Terms of Use.